This Privacy Policy explains how Royal Wave Media, Inc. ("we," "us," or "our") collects, uses, stores, and protects information when you use Royaltally ("the Service"). We are committed to handling your data responsibly and transparently.
Account information. When you register, we collect your username, email address, first and last name, and a password (stored as a bcrypt hash — we never store your password in plain text). During onboarding, you may also provide your business name and address for use on PDF statements.
Catalog and earnings data. You upload and enter data about your works, editions, royalty holders, allocations, earnings, advances, adjustments, and payments. This is your business data and you retain full ownership of it.
Distributor reports. When you upload XLSX or CSV files from distributors, the files are stored on our server for processing. The data read from them is stored in your account's database records.
Payment information. Subscription billing is handled by Stripe. We store your Stripe customer ID and subscription ID to manage your plan, but we never store credit card numbers, bank account details, or other payment credentials on our servers. Stripe's privacy policy applies to payment data: stripe.com/privacy.
Usage data. We log actions within the Service (uploads, imports, report generation, etc.) for audit and debugging purposes. We do not use third-party analytics or tracking services. We do not track you across other websites.
We use your information to:
When you submit business data to the Service (such as catalog, earnings, and royalty holder information), we process that data on your behalf to provide the Service. We act as a service provider with respect to your business data and use it only as described in these terms.
We do not sell, rent, or share your personal information or individually identifiable business data with third parties for marketing or advertising purposes. We will never send you marketing emails without your explicit consent.
Sharing at your direction (royalty holder portal). If you invite a royalty holder to the viewer portal, that person can sign in to see the specific earnings, statements, and payment information that relate to them — and only that. This sharing happens at your direction: you choose who to invite, the recipient sees only their own figures (never your wider catalog or other holders' data), and you can revoke access at any time.
The Service uses a limited number of third-party services:
Royaltally uses session cookies only. A session cookie is set when you log in to keep you authenticated as you navigate the Service. This cookie expires when you log out, or one hour after you log in. We do not use advertising cookies, tracking cookies, or any third-party cookie services.
Your data is stored in a MySQL database on servers provided by SiteGround, a reputable hosting provider. All data is transmitted over HTTPS (encrypted in transit). Passwords are hashed with bcrypt. Database access is restricted to authorized personnel and application processes.
We use application-level access controls designed to ensure that users can access only data associated with their own account. Every database query is scoped to the authenticated user's ID. While no system can guarantee absolute security, we implement commercially reasonable administrative, technical, and physical safeguards to protect your data.
Breach notification. In the event of a data breach affecting your personal information, we will notify affected users as required by applicable law. Where appropriate, we will also provide information about what occurred and steps you can take to protect yourself.
We may use data from across the Service to compile de-identified, aggregated statistics about the publishing industry — for example, earnings trends by format, platform comparisons, or seasonal patterns. Before any such use, data is processed using measures reasonably designed to prevent re-identification, so that no individual user, business, title, or royalty holder can be identified.
We may publish these de-identified statistics in industry reports, blog posts, or other content. We will not publish or disclose aggregated data where a small sample size, unique title set, niche genre, or other contextual factor could reasonably permit reverse engineering of a specific customer's information. We apply internal disclosure controls before any publication of aggregated statistics.
Aggregated data is statistical in nature. Other than the limited, you-directed sharing described in Section 2 (the royalty holder portal), your individual account data — catalog, earnings figures, royalty holder details, and uploaded reports — is never shared, disclosed, or made available to anyone outside of your account.
We retain your data for as long as your account is active. Uploaded report files are stored on the server for processing and reference. If you delete your account, all associated data (account info, catalog, earnings, uploaded files, and audit logs) will be deleted within 30 days. Encrypted backups may retain data for up to 90 days after deletion.
You have the right to:
If you are located in the European Economic Area (EEA) or the United Kingdom (UK), the following additional information applies to you.
Legal bases for processing. We process your personal data on the following legal bases: (a) contract necessity — to provide and operate the Service as described in our Terms of Service; (b) legitimate interests — to maintain security, prevent fraud, improve the Service, and compile de-identified aggregated statistics, where those interests are not overridden by your rights; and (c) consent — where we rely on consent for specific processing activities (e.g., optional marketing communications), which you may withdraw at any time.
International transfers. Your data is stored and processed in the United States. By using the Service, you acknowledge that your data will be transferred to the United States. We rely on standard contractual clauses or other lawful transfer mechanisms as required by applicable data protection law to safeguard your data during international transfers.
Your rights. In addition to the rights listed in Section 8 above, you have the right to request restriction of processing, the right to data portability, and the right to object to processing based on legitimate interests. You also have the right to lodge a complaint with your local data protection supervisory authority.
Contact for privacy inquiries. For any privacy-related requests or questions, contact us at support@royaltally.com.
Royaltally is not intended for use by individuals under 18 years of age. We do not knowingly collect personal information from children. If you believe a child has created an account, please contact us and we will delete it promptly.
We may update this Privacy Policy from time to time. If we make material changes, we will notify you by email or by posting a notice within the Service. The "Last updated" date at the top of this page indicates when the policy was last revised.
If you have questions about this Privacy Policy or how we handle your data, contact us at:
Royal Wave Media, Inc.
Email: support@royaltally.com