Privacy Policy

1. Introduction

SuperDarkCode Labs (Private) Limited, a company registered in Zimbabwe (D-U-N-S® Number 631177843), trading as Music Localhost ("Company," "we," "us," or "our") operates the Music Localhost platform, accessible at music.localhost.co.zw and records.localhost.co.zw, including the website, mobile applications, Telegram and WhatsApp bots, APIs, and all related services (collectively, the "Platform"). This Privacy Policy is read together with our Terms of Service.

This Privacy Policy explains how we collect, use, share, store, and protect your personal information when you access or use the Platform. It applies to all users of the Platform, including listeners, artists, producers, studio managers, and administrators. By creating an account or using the Platform, you acknowledge that you have read and understood this Privacy Policy and consent to the collection and processing of your information as described herein.

We are committed to protecting your privacy and handling your data responsibly. If you do not agree with this Privacy Policy, please do not use the Platform.

2. Information We Collect

We collect different types of information depending on how you interact with the Platform. The categories of information we collect include:

2.1 Account Information

When you create an account, we collect your phone number (used for OTP-based authentication), email address (if provided), display name, date of birth, and any profile information you choose to add, including profile photo, biography, location, and social media links. Your phone number serves as your primary identifier and authentication credential.

2.2 Artist & KYC Information

If you register as an artist, producer, or studio manager, we collect additional information to verify your identity and process payouts. This includes your legal full name, national identification number or passport number, a photograph of your government-issued identification document, a selfie photograph for identity matching, proof of address (if requested), and banking details or EcoCash mobile money details for payout processing. This information is collected as part of our Know Your Customer (KYC) verification process and is required before payouts can be processed.

2.3 Content

When you upload content to the Platform, we collect and store the audio files (tracks, beats, albums), cover artwork and promotional images, metadata (track titles, artist names, songwriter credits, producer credits, genre, release date, ISRC codes, UPC/EAN codes), lyrics, and any descriptions or tags you associate with your content.

2.4 Usage Data

We automatically collect information about how you interact with the Platform, including tracks and beats you play, stream, or purchase; play counts and listening duration; listening history and playback patterns; search queries; playlists you create, follow, or interact with; artists you follow; pages and features you access; and the dates and times of your activity.

2.5 Device & Technical Data

When you access the Platform, we automatically collect technical information from your device, including your IP address, browser type and version, operating system and version, device type (desktop, mobile, tablet), device identifiers, screen resolution, language and locale settings, referring URL, and network connection type. This data is collected through standard web technologies and is used to optimise the Platform's performance and security.

2.6 Payment Data

When you make or receive payments through the Platform, we collect transaction records (amounts, dates, descriptions, and status), subscription and membership history, payout history and payout method details, and invoices and receipts. Full payment card numbers are processed by our payment processor, Pesepay, and are not stored on our servers. We retain only truncated card details (e.g., last four digits) for your reference and transaction verification.

3. How We Use Your Information

We use the information we collect for the following purposes:

• Service Provision: To create and manage your account, authenticate your identity via phone-based OTP, host and stream your content, process your uploads, and provide all core features of the Platform;
• Music Distribution: To transmit your content, metadata, and associated information through our distribution network to streaming platforms and digital stores as directed by you;
• Analytics & Insights: To compile and present aggregated analytics on play counts, listener demographics, trending content, and revenue performance to artists and the platform;
• Payment Processing: To process subscription payments, beat purchases, and other transactions through Pesepay; to calculate, track, and disburse royalty payouts and beat sale revenues;
• Fraud Prevention & Security: To detect, investigate, and prevent fraudulent activity, stream manipulation, bot activity, account abuse, and other violations of our Terms of Service; to monitor for artificial streaming patterns and enforce our anti-fraud policies;
• Communications: To send you platform notifications (new followers, track releases, beat sales, payout updates), transactional communications (OTP codes, payment confirmations, payout notifications), and, where you have opted in, marketing communications about new features, promotions, or content;
• Platform Improvement: To understand how users interact with the Platform, diagnose technical issues, improve existing features, develop new features, and optimise the user experience;
• Legal Compliance: To comply with applicable laws, regulations, and legal processes; to respond to lawful requests from government authorities; to enforce our Terms of Service; and to protect our rights, privacy, safety, and property, and those of our users and the public.

4. How We Share Your Information

We share your information only in the circumstances described below. We do not sell your personal information to third parties.

4.1 Distribution Aggregator & DSPs

When you submit content for distribution, your stage name, track and album metadata, cover artwork, audio masters, and identifiers (ISRC, UPC, ISWC) are transmitted through our distribution network and onward to the Digital Service Providers ("DSPs") you select — including Spotify, Apple Music, Boomplay, Audiomack, YouTube Music, Deezer, Tidal, Amazon Music, and others. Each DSP receives the information necessary to list, stream, and attribute your content, and processes it under its own privacy policy.

4.2 Payment Processor — Pesepay

Payment transactions are processed by Pesepay (Pvt) Ltd, which supports EcoCash mobile money, bank transfers, and card payments. We share the necessary transaction data — your name, phone number, EcoCash number, bank details, and transaction amounts — with Pesepay to complete processing. Full payment-card numbers are not stored on our servers; we retain only truncated card details (e.g. last four digits) for reference. Pesepay processes data under its own privacy policy and applicable financial regulations.

4.3 Cloud Storage & CDN — Cloudflare

Audio masters, transcoded HLS segments, artwork, and supporting assets are stored in Cloudflare R2 with server-side encryption and delivered through Cloudflare's global content delivery network using signed, time-limited URLs to prevent unauthorised access. Cloudflare may process technical data (IP addresses, request headers) as part of CDN, security, and DDoS-protection services.

4.4 SMS Provider — SMS Localhost

To deliver OTP verification codes for account authentication, we share your phone number with SMS Localhost. SMS Localhost uses your phone number solely to deliver the OTP message and does not retain it beyond what is necessary to complete delivery.

4.5 Fraud & Sanctions Screening Providers

We may share registration, KYC, and transaction data with third-party fraud-detection and sanctions-screening services to identify high-risk activity, screen against UN, OFAC, EU, and UK sanctions and Politically Exposed Person ("PEP") registers, and comply with our anti-money-laundering ("AML") obligations. These providers are contractually limited to using the data for those purposes.

4.6 Sub-processor Summary

We will update this list as our sub-processors change. Material changes that affect categories of data processed will be notified through the Platform.

4.7 Analytics (Aggregated Data)

We may share aggregated, anonymised, or de-identified data that cannot reasonably be used to identify you with third parties for research, analytics, industry reporting, or business development purposes. We also provide artists with aggregated, anonymised analytics about their content's performance — total plays, geographic distribution, demographic trends, playlist inclusions. Artists cannot see which specific listeners played their tracks or any personally identifiable listener information. This data does not constitute personal information.

4.8 Law Enforcement & Legal Obligations

We may disclose your personal information if we believe in good faith that such disclosure is necessary to: comply with a legal obligation, court order, subpoena, or other legal process; protect and defend the rights, property, or safety of Music Localhost, our users, or the public; detect, prevent, or address fraud, security issues, or technical problems; or respond to lawful requests from government authorities, including law enforcement and regulatory agencies.

4.9 No Sale of Personal Data

We do not sell, rent, or trade your personal information to third parties for their marketing purposes. We will never monetise your personal data by making it available to data brokers, advertisers, or other commercial entities.

5. Data Storage & Security

We take the security of your personal information seriously and implement appropriate technical and organisational measures to protect it against unauthorised access, alteration, disclosure, or destruction. These measures include:

• Encryption in Transit: All data transmitted between your device and the Platform is encrypted using TLS (Transport Layer Security) / HTTPS;
• Secure Cloud Storage: Audio files, artwork, and content are stored with server-side encryption and strict access controls;
• Authentication Security: User authentication is performed via phone-based OTP, with secure token-based session management. Tokens are securely issued and validated;
• Access Controls: Internal access to personal data is restricted to authorised personnel on a need-to-know basis, with role-based access controls enforced;
• Monitoring: We monitor our systems for security incidents, suspicious activity, and potential vulnerabilities.

Despite our efforts, no method of electronic transmission or storage is completely secure. We cannot guarantee the absolute security of your data and accept no liability for any breach of security beyond our reasonable control.

5.1 Breach Notification

In the event of a personal-data breach that is likely to result in a risk to the rights and freedoms of affected users, we will notify affected users without undue delay, and the relevant data-protection authority within seventy-two (72) hours of becoming aware, where required by applicable law. Our notification will describe: the nature of the breach; the categories and approximate number of individuals affected; the likely consequences; and the measures we have taken or propose to take to address the breach and mitigate its effects.

5.2 Anti-Fraud & Streaming Manipulation Monitoring

We monitor activity on the Platform to detect bots, click farms, incentivised streaming, account-takeover attempts, payment fraud, and coordinated chart-gaming, using a combination of statistical models, machine-learning detectors, and third-party fraud-screening services. Where we identify suspicious activity, we may freeze affected accounts, withhold royalty payouts pending investigation, and — for confirmed violations — terminate the account and forfeit accrued royalties as set out in our Terms of Service.

5.3 KYC, AML & Sanctions Screening

To meet our anti-money-laundering and sanctions obligations, we screen Artist and Producer accounts against UN, OFAC, EU, and UK sanctions lists, and against PEP registers. KYC documents (government-issued ID, selfie, proof of address, banking details) are encrypted at rest and access is restricted to authorised compliance personnel on a need-to-know basis. We retain KYC records for the duration of your account plus five (5) years after deletion, in line with regulatory requirements.

6. Cookies & Tracking Technologies

The Platform uses the following technologies to enhance your experience and provide our services:

• Session Tokens: We use secure authentication tokens stored in your browser to manage your authenticated session. These tokens are essential for the Platform to function and are used to verify your identity on each request;
• Local Storage: We use browser local storage to persist user preferences (such as theme settings and playback state) and session data across visits;
• Session Data: Temporary session information may be stored to maintain your browsing state and provide a seamless experience as you navigate the Platform;
• Analytics: We collect aggregated usage data to understand how users interact with the Platform, identify popular content, diagnose errors, and improve our services. This data is processed internally and is not shared with third-party advertising networks.

The Platform does not use third-party advertising cookies or tracking pixels. We do not serve targeted advertisements. We do not participate in cross-site tracking or retargeting.

7. Your Rights

Depending on your jurisdiction, you may have certain rights regarding your personal information. We respect these rights and will facilitate their exercise to the extent required by applicable law. Your rights may include:

• Right of Access: You may request a copy of the personal information we hold about you, including account data, content metadata, usage history, and payment records;
• Right to Correction: You may request that we correct any inaccurate or incomplete personal information. You can update most account information directly through your profile settings;
• Right to Deletion: You may request that we delete your personal information. Please note that certain data may be retained where we have a legal obligation to do so (e.g., financial records for tax and regulatory compliance) or where retention is necessary for legitimate business purposes (e.g., resolving disputes, enforcing our Terms). Content that has been distributed to third-party platforms will be subject to takedown requests, and residual copies may persist on those platforms;
• Right to Data Portability: You may request a copy of your personal information in a structured, commonly used, machine-readable format for transfer to another service;
• Right to Opt Out of Marketing: You may opt out of receiving marketing and promotional communications from us at any time by adjusting your notification settings or contacting us. This does not apply to transactional or service-related communications (e.g., OTP codes, payout notifications, security alerts).

To exercise any of these rights, please contact us at privacy@localhost.co.zw. We will respond to your request within thirty (30) days. We may request additional information to verify your identity before processing your request. We will not discriminate against you for exercising any of your rights.

8. Children's Privacy

The Platform is not intended for or directed at children under the age of sixteen (16). We do not knowingly collect, solicit, or maintain personal information from anyone under the age of sixteen. Users between the ages of sixteen (16) and eighteen (18) may use the Platform only with verifiable parental or guardian consent, as specified in our Terms of Service.

If we become aware that we have collected personal information from a child under sixteen (16) without appropriate consent, we will take prompt steps to delete such information from our records. If you are a parent or guardian and believe that your child under sixteen has provided us with personal information without your consent, please contact us immediately at privacy@localhost.co.zw.

9. International Data Transfers

Music Localhost is based in Zimbabwe, but your personal information may be processed, stored, and transferred to servers and facilities located outside of Zimbabwe. In particular:

• Audio files and content are stored on secure cloud storage infrastructure with global reach. Your content may be cached or stored in data centres located in various countries worldwide to optimise delivery performance;
• Distribution data is transmitted through our distribution network and onward to streaming platforms that operate internationally;
• Technical infrastructure and support services may involve processing in jurisdictions outside Zimbabwe.

Where your data is transferred outside Zimbabwe, we take appropriate safeguards to ensure that your personal information is protected in accordance with this Privacy Policy. These safeguards include data processing agreements with our service providers that require them to protect your information to a standard consistent with applicable data protection laws, and the use of encryption and access controls to secure data in transit and at rest.

By using the Platform, you acknowledge and consent to the transfer, processing, and storage of your personal information in countries outside of Zimbabwe where data protection laws may differ from those in your jurisdiction.

10. Data Retention

We retain your personal information for as long as necessary to fulfil the purposes for which it was collected, comply with our legal obligations, resolve disputes, and enforce our agreements. The specific retention periods are as follows:

• Account Data: We retain your account information (name, phone number, email, profile details) for the duration of your active account plus two (2) years following account deletion or termination. This allows us to address any post-termination enquiries, disputes, or legal claims;
• Financial Records: Transaction records, payment history, payout records, invoices, and related financial data are retained for seven (7) years from the date of the transaction, in compliance with applicable tax, accounting, and financial regulatory requirements;
• KYC Documents: Identity verification documents (ID copies, selfie photographs) are retained for the duration of your account plus five (5) years following account deletion, in accordance with anti-money laundering and regulatory requirements;
• Content: Audio files, artwork, and associated metadata are deleted from our primary storage upon your request, subject to the distribution wind-down period described in our Terms of Service. Content that has been distributed to third-party platforms is subject to the removal timelines of those platforms. Cached or archived copies may persist in our backup systems for up to ninety (90) days following deletion;
• Usage & Analytics Data: Individual usage data (listening history, search queries) is retained for two (2) years from the date of collection. Aggregated and anonymised analytics data (platform-wide trends, statistical summaries) is retained indefinitely, as it cannot be used to identify individual users;
• Technical Logs: Server logs, access logs, and security event logs are retained for twelve (12) months for security and operational purposes.

When personal information is no longer required for any purpose, we will securely delete or anonymise it in accordance with our data destruction procedures.

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, services, technology, legal requirements, or other factors. When we make material changes, we will:

• Post the updated Privacy Policy on the Platform with a revised effective date;
• Send a notification through the Platform (via in-app notification or banner);
• Where appropriate, notify you via email or SMS to the contact information associated with your account.

Your continued use of the Platform after the effective date of the updated Privacy Policy constitutes your acceptance of the changes. We encourage you to review this Privacy Policy periodically to stay informed about how we are protecting your information. The "Last updated" date at the top of this page indicates when the Privacy Policy was most recently revised.

12. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us at:

We will respond to all privacy-related enquiries within thirty (30) days of receipt. If you are not satisfied with our response, you may have the right to lodge a complaint with the relevant data protection authority in your jurisdiction.