CAVERNIUM
PRIVACY POLICY
Version 1.0
Effective Date: 29 September 2026
1. Introduction
CAVERNIUM respects the privacy of individuals who use its website, applications, services, and related features (collectively, the “Service”). This Privacy Policy explains how CAVERNIUM collects, uses, stores, discloses, and otherwise processes personal data in connection with the Service.
This Privacy Policy is intended to operate together with the CAVERNIUM Global Terms & Conditions, Copyright & Intellectual Property Policy, Community & Content Policy, and any other policies expressly incorporated into the Service.
CAVERNIUM is intended to operate as an international service. Privacy and data-protection obligations may differ depending on the user's location, the location of the processing, and the nature of the relevant activity. CAVERNIUM will comply with mandatory privacy and data-protection requirements that apply to the relevant processing activity or jurisdiction.
2. Who We Are — Data Controller
For purposes of applicable data-protection law, the entity responsible for the relevant processing is:
CAVERNIUM
Website: https://cavernium.com
Privacy Contact: privacy@cavernium.com
Where applicable law requires a locally established representative, privacy contact, or other designated contact, CAVERNIUM will provide or designate the required information.
3. Scope of This Privacy Policy
This Privacy Policy applies to personal data processed through the CAVERNIUM Service, including account registration, user profiles, artist profiles, music uploads, playback, ratings, reviews, saves, follows, discoveries, and related community features.
It does not govern the privacy practices of independent third-party websites, services, or providers that may be linked from or integrated with CAVERNIUM. Those services may have their own privacy policies and terms.
Where a specific CAVERNIUM feature provides a separate privacy notice or consent request, that notice supplements this Privacy Policy for the relevant processing.
4. Information We Collect
CAVERNIUM currently processes the following categories of information, to the extent provided or generated through use of the Service:
4A. Account and Authentication Data
Account identifiers and authentication-related information necessary to create, authenticate, secure, and maintain an account, including email address and account identifier.
CAVERNIUM may maintain records necessary to demonstrate acceptance of its Terms, including the applicable version and date and time of acceptance, subject to applicable law.
4B. Profile Data
Profile information may include username, display name, profile image or avatar, country, biography, and profile visibility settings.
Information selected by a user to be publicly visible may be accessible to other users and, depending on the Service configuration, to visitors who do not have an account.
4C. Artist Data
Artist information may include artist name, biography, genres, profile or cover image, verification status, contact email, and whether a contact email is intended to be publicly visible.
Users are responsible for ensuring that they have the necessary rights and permissions to submit personal information, photographs, names, likenesses, artwork, or other third-party material through the Service.
4D. Music and User-Submitted Content
Music and related metadata may include track title, description, audio file, cover artwork, genre, subgenre, country, language, duration, lyrics, creation-method information, AI tool information, human involvement information, explicit-content status, and publication status.
User-submitted Content may contain personal data relating to the uploader or other persons. CAVERNIUM processes such information as necessary to provide the relevant Service and in accordance with applicable law and the CAVERNIUM Copyright & Intellectual Property Policy.
4E. Ratings, Listening and Interaction Data
CAVERNIUM may process ratings, rating scores, listened percentage, revaluation information, listen start times, listened seconds, completion information, ranking-eligibility information, track-version information, saves, follows, discoveries, and other interactions with the Service.
These data may be used to operate ratings, rankings, discovery features, recommendations, statistical functions, moderation, fraud prevention, and other features described in the Service.
Where CAVERNIUM registers approximate audience location for listening analytics, it may derive a country-level code from network or IP-related information associated with the request. CAVERNIUM does not use precise device GPS for this purpose and does not store precise geographic coordinates in the listening record. Country-level audience information may be used in aggregated analytics and artist-facing statistical features, subject to applicable law and the privacy safeguards described in this Privacy Policy.
4F. Reviews and Community Activity
Reviews may include the review text, the user who submitted it, the associated track and rating, revaluation information, and creation or update timestamps.
CAVERNIUM may also process information concerning interactions with reviews, such as whether a user marked a review as helpful.
4G. Technical and Security Data
CAVERNIUM and its service providers may process technical information necessary to authenticate users, maintain security, prevent abuse, operate the Service, diagnose technical problems, maintain backups, and comply with applicable law.
Depending on the systems and providers involved, such information may include session, device, network, security, authentication, diagnostic, and log information. CAVERNIUM does not treat every field technically generated by an infrastructure provider as a separate CAVERNIUM purpose; processing is limited to what is necessary for the applicable operational or legal purpose.
4H. Uploaded Files and Storage
Audio files, cover images, and other files submitted through the Service may be stored using CAVERNIUM's infrastructure and third-party infrastructure providers. Storage and delivery arrangements may change as the Service develops.
5. How We Use Personal Data
CAVERNIUM may use personal data for the following purposes:
5A. Providing and Operating the Service
• Create and maintain accounts; authenticate users; provide profiles and artist pages; store and deliver uploaded Content; enable music playback; provide ratings, reviews, saves, follows, discoveries, rankings, and other Service functionality.
5B. Discovery, Rankings and Recommendations
Process listening, rating, interaction, and Content data to operate discovery, recommendation, ranking, and related features. The Terms explain that discovery systems may use technical, statistical, editorial, community, or other criteria that may change over time.
5C. Security, Integrity and Abuse Prevention
• Detect, investigate, prevent, and respond to fraud, manipulation, unauthorized access, abuse, security incidents, infringement, and other activity that may threaten the Service, users, or third-party rights.
5D. Communications
• Send account, security, Service, policy, moderation, copyright, legal, and other operational communications permitted by applicable law.
5E. Legal and Regulatory Compliance
• Comply with applicable laws, regulations, legal processes, court orders, regulatory requests, and enforceable governmental requirements; establish, exercise, or defend legal rights and claims.
5F. Service Improvement and Statistical Analysis
• Operate, maintain, troubleshoot, analyze, improve, develop, and secure the Service, including through statistical and aggregated analysis.
Where information has been aggregated or anonymized so that individuals are no longer reasonably identifiable, CAVERNIUM may use it for lawful purposes, subject to applicable law. CAVERNIUM will not use anonymization or aggregation language to circumvent applicable data-protection requirements.
6. Legal Bases for Processing
Where applicable law requires a legal basis, CAVERNIUM will rely on the basis appropriate to the relevant processing activity. Depending on the jurisdiction and circumstances, this may include:
6A. Performance of a Contract or Provision of the Service
Processing necessary to create an account, provide requested functionality, store and deliver Content, process ratings and listens, operate social features, and otherwise provide the Service.
6B. Consent
Where applicable law requires consent, or where CAVERNIUM elects to rely on consent, consent will be requested in an appropriate manner and may be withdrawn subject to applicable legal limitations and the technical consequences of withdrawal.
6C. Legal Obligations
Processing necessary to comply with applicable legal or regulatory obligations.
6D. Legitimate Interests or Equivalent Legal Grounds
Where recognized by applicable law, CAVERNIUM may rely on legitimate interests or another comparable legal ground for purposes such as security, fraud prevention, Service integrity, dispute management, and reasonable improvement of the Service, provided that the applicable legal requirements are satisfied.
7. Publicly Visible Information
Some information is intentionally made public as part of CAVERNIUM's functionality. Depending on a user's settings and the Service configuration, this may include username, display name, avatar, country, biography, artist information, track information, ratings, reviews, saves, follows, or other public activity.
Users should not submit information that they do not want to make publicly available where the relevant feature is public.
Public availability does not remove CAVERNIUM's obligations under applicable data-protection law. Users may have rights to request correction, restriction, deletion, or other remedies where provided by applicable law.
8. Music, Ratings, Reviews and Community Content
CAVERNIUM processes user-submitted Content and associated activity to provide the platform's music-discovery and community functions.
Users remain responsible for the rights, permissions, licenses, consents, and authorizations required for Content they submit. This includes, where applicable, rights relating to recordings, compositions, lyrics, performances, artwork, photographs, names, likenesses, trademarks, and other protected material.
Copyright and intellectual-property complaints are handled under the CAVERNIUM Copyright & Intellectual Property Policy. That policy may require CAVERNIUM to process information contained in complaints, counter-notices, evidence, correspondence, and related records.
9. Cookies and Similar Technologies
CAVERNIUM may use strictly necessary cookies, local storage, session technologies, or similar mechanisms where required to authenticate users, maintain security, remember necessary settings, and operate the Service.
At the time of this draft, no separate advertising-cookie or behavioral-advertising system has been identified in the verified CAVERNIUM data model. If CAVERNIUM introduces analytics, advertising, tracking, or other non-essential technologies that require additional notice or consent, this Privacy Policy and any related consent mechanism will be updated before or when those technologies are deployed, as required by applicable law.
10. Service Providers and Data Processors
CAVERNIUM may use third-party providers and infrastructure necessary to operate the Service, including providers of hosting, database, authentication, storage, security, communications, analytics, content delivery, payment processing, or other technical services.
Where a provider processes personal data on CAVERNIUM's behalf, CAVERNIUM will use contractual, technical, and organizational safeguards required by applicable law.
Third-party providers may process information in accordance with their own terms and privacy policies where they act independently rather than solely on CAVERNIUM's instructions.
11. International Data Transfers
CAVERNIUM operates as an international service and may use infrastructure or service providers located outside the user's country.
Where personal data is transferred internationally, CAVERNIUM will implement the transfer mechanism and safeguards required by the applicable data-protection law, which may include an adequacy decision, contractual safeguards, consent, another legally recognized mechanism, or a jurisdiction-specific exception.
The applicable mechanism may differ depending on the jurisdiction, type of data, recipient, and purpose of the transfer.
12. Data Retention
CAVERNIUM does not retain all personal data for a single fixed period. Retention depends on the type of information, the purpose for which it is processed, the user's relationship with CAVERNIUM, operational requirements, security needs, disputes, backups, and legal obligations.
Account and profile information will generally be retained while the account remains active, subject to applicable law and deletion requests.
Content, ratings, reviews, listening records, and other historical activity may be retained for as long as reasonably necessary to provide the relevant functionality, maintain historical records, preserve system integrity, address disputes, prevent abuse, or comply with legal obligations.
Following account termination or Content removal, CAVERNIUM may retain limited information where reasonably necessary for legal compliance, copyright disputes, fraud prevention, security, backups, accounting or recordkeeping, dispute resolution, enforcement of its policies, or other lawful purposes.
Retention periods and deletion procedures will be reviewed as the Service develops and will be adjusted where applicable law requires shorter or specific retention periods.
13. Data Security
CAVERNIUM will implement reasonable technical and organizational measures appropriate to the nature and risks of the processing to protect personal data against unauthorized access, alteration, disclosure, loss, destruction, or other unlawful processing.
Security measures may include access controls, authentication controls, infrastructure security, backups, monitoring, incident-response procedures, and other safeguards appropriate to the Service.
No internet-based service can guarantee absolute security. Users should protect their authentication credentials and promptly report suspected unauthorized access.
Where applicable law requires notification of a personal-data security incident, CAVERNIUM will follow the applicable notification and response requirements.
14. Your Privacy Rights
Depending on the applicable law and circumstances, individuals may have rights including:
14A. Access
The right to request information about personal data held or processed about you and, where required, obtain access to that information.
14B. Rectification
The right to request correction or updating of inaccurate or incomplete personal data.
14C. Deletion
The right to request deletion of personal data where the applicable legal requirements are satisfied.
14D. Restriction or Objection
The right, where provided by applicable law, to request restriction of processing or object to particular processing activities.
14E. Data Portability
Where applicable, the right to receive certain personal data in a structured, commonly used, and machine-readable format or request transmission to another controller where legally required.
14F. Withdrawal of Consent
Where processing is based on consent, the right to withdraw consent, without affecting the lawfulness of processing carried out before withdrawal.
14G. Complaint
The right to lodge a complaint with the competent data-protection authority or other regulator where such a right exists.
15. How to Exercise Your Rights
Requests concerning personal data should be submitted through the designated privacy contact:
Privacy Contact: privacy@cavernium.com
CAVERNIUM may request information reasonably necessary to verify the identity and authority of the requester, particularly where disclosure could affect another person's privacy or account security.
CAVERNIUM will respond within the time required by applicable law. Where a request cannot be fulfilled in whole or in part, CAVERNIUM will provide an explanation to the extent required by applicable law.
16. Account Deletion and Data Deletion
Users may request deletion of their account and associated personal data through the available account controls or the designated privacy contact.
Deletion does not necessarily require immediate or complete removal of every copy of every item. CAVERNIUM may retain limited information where necessary for legal compliance, security, fraud prevention, copyright or intellectual-property disputes, accounting, backups, dispute resolution, enforcement, or other lawful purposes.
Public Content may also be subject to separate rights, licensing, moderation, copyright, and historical-record considerations described in the Terms and applicable policies.
17. Children and Minors
CAVERNIUM's Global Terms & Conditions currently establish a minimum account age of 16, subject to higher age requirements, parental authorization, or other requirements imposed by applicable law.
CAVERNIUM does not knowingly permit persons below the applicable minimum age to create or maintain accounts. If CAVERNIUM becomes aware that an account was created in violation of applicable age requirements, it may restrict or terminate the account and take appropriate measures concerning associated personal data in accordance with applicable law.
Where a jurisdiction imposes additional requirements concerning children or minors, CAVERNIUM will apply those mandatory requirements to the relevant users and processing activities.
18. Third-Party Links and Services
CAVERNIUM may contain links to or integrations with third-party websites, applications, platforms, payment services, social networks, or other services.
CAVERNIUM is not responsible for the privacy practices of independent third parties. Users should review the privacy notices applicable to those services before providing personal data to them.
19. Copyright and Personal Data in User-Submitted Content
User-submitted Content may contain personal data, including names, images, voices, biographical information, contact information, or information relating to performers and other individuals.
Users must have the rights, permissions, licenses, and consents required to submit such information and make the Content available through CAVERNIUM.
When CAVERNIUM receives a copyright, intellectual-property, privacy, or related complaint, it may process the personal data contained in the complaint and supporting documentation for the purpose of evaluating and responding to the matter, complying with legal obligations, and maintaining records of the dispute.
20. Automated Processing and Profiling
CAVERNIUM currently uses listening, rating, interaction, and Content data to operate discovery, ranking, recommendation, and related platform functions.
The existence of statistical or algorithmic processing does not by itself mean that CAVERNIUM makes decisions producing legal or similarly significant effects through automated processing.
If CAVERNIUM introduces processing that constitutes profiling or automated decision-making subject to specific legal safeguards, CAVERNIUM will provide the notices, rights, and safeguards required by the applicable law.
21. Changes to This Privacy Policy
CAVERNIUM may update this Privacy Policy as the Service, technology, legal requirements, or processing activities change.
Non-material administrative, corrective, or security-related changes may take effect as permitted by applicable law. Material changes will be communicated through reasonable means where required.
Where applicable law requires affirmative consent to a material change in processing, CAVERNIUM will obtain that consent before implementing the relevant processing.
22. Applicable Law and Mandatory Privacy Rights
This Privacy Policy is intended to operate consistently with the laws applicable to CAVERNIUM and the relevant processing activity.
Uruguayan data-protection law, including Law No. 18,331 and its applicable amendments and regulations, forms part of the legal framework relevant to CAVERNIUM as a Uruguayan business.
Depending on the user, processing activity, and jurisdiction, other mandatory privacy and data-protection laws may also apply. Nothing in this Privacy Policy is intended to exclude, waive, or reduce mandatory rights or protections that cannot lawfully be excluded.
References to a particular jurisdiction's law do not mean that such law governs every user or every processing activity carried out by CAVERNIUM.
23. Contact Information
For general privacy questions, data-subject requests, or concerns regarding personal-data processing:
CAVERNIUM
Website: https://cavernium.com
Privacy Contact: privacy@cavernium.com
Separate contact channels may be established for copyright complaints, legal notices, support requests, and other matters.
24. Data Protection Authority / Regulatory Information
For matters subject to Uruguayan data-protection law, the competent authority is the Unidad Reguladora y de Control de Datos Personales (URCDP), subject to its jurisdiction and applicable procedures.
Where another jurisdiction's law grants a right to complain to a different supervisory authority, the applicable authority and procedure may depend on the individual's location and the relevant processing activity.
25. Effective Date and Version
Effective date: 29 September 2026
Version: 1.0
This Privacy Policy is effective as of the date indicated above and may be updated from time to time in accordance with Section 21 of this Privacy Policy.