Privacy notice

This notice covers the Mazufa Records website (mazufa.com, in every language), the invitation application, the newsletter and optional site measurement. Mazufa Records is responsible for the personal data described here. You can contact us about privacy, including any request under this notice, at contact@mazufa.com.

What we collect depends on what you do:

• Application. The path you choose (artist or label); what you are applying as; your artist, act or company name; email address; country or region; main genre (artists); short bio (optional); track or release title (artists); links to your music, or links to your roster or catalogue (labels); optional links that show your numbers, such as streaming statistics or an earnings dashboard; the number of artists on your roster and your catalogue size (labels); how you heard about Mazufa; anything else you choose to write; the form language, used as your preferred reply language; your rights confirmation, your privacy confirmation and the notice version; a random submission ID; and a portfolio link taken from the first link you give. The form does not accept file uploads.
• WhatsApp updates (optional). If you enter a WhatsApp number and tick “Send me updates about my application on WhatsApp too”, we receive that number and your choice. Without the tick, the number is not sent.
• Optional artist search. If you use the artist-profile search in the form, the search term you type is sent through our server to Apple’s public music catalogue, which returns matching artist names, IDs and profile links.
• Newsletter. If you sign up: your email address and the page where you signed up.
• Optional session measurement. Only if you choose “Allow measurement”: a limited record of the public pages, approved source tags and form steps of your visit in that browser tab. If you then submit an application, this record may be linked to it, including the contact details you give in the application. It does not contain your raw IP address, and we use no advertising cookies and no cross-site tracking. Choosing “Necessary only” does not affect the review of an application.
• Source tags. Campaign tags in the link you followed (utm_source, utm_medium, utm_campaign, utm_content, utm_term) are kept in your browser tab and sent with an application, or to our own server together with the landing page and page language. Advertising click identifiers (gclid, fbclid, ttclid) and referral codes are used only if you allow measurement.
• Browser storage. The site keeps a few items in your browser: mz_privacy_v1 (your measurement choice; localStorage, until you change it or clear your browser data), mz_lang_choice_v1 (your language choice; localStorage), mazufa-application-draft-v1 (your unsent application draft; sessionStorage, up to two hours), mazufa-application-completed-v1 (a marker that an application was sent from that tab; sessionStorage), mz_attribution_v1 (source tags; sessionStorage) and, only if you allow measurement, mz_measurement_session_timeline_v1, mz_measurement_session_timeline_linked_v1, mz_measurement_attempt_v1 (sessionStorage). sessionStorage is cleared when you close the tab. Nothing in this storage is used for advertising.
• Free browser tools. The free calculators and tools run in your browser. What you type into them is processed on your device and is not uploaded to us.
• Emails you send us. Your email address, your message and any attachments you choose to send.
• Server and security logs. Our server necessarily receives connection data, such as your IP address, browser type and the page requested. For rate limiting we derive a daily keyed hash of the IP address; the application record does not store the raw IP address. Our hosting provider keeps its own technical logs.
• Web fonts on older pages. If an older page loads fonts from Google Fonts, Google receives your IP address and browser information when the font is fetched.

• Reviewing your application, contacting you about it and preparing any agreement: steps taken at your request before a possible contract (GDPR art. 6(1)(b)).
• WhatsApp updates, the newsletter, optional session measurement and advertising click identifiers: your consent (art. 6(1)(a)). You can withdraw consent at any time; this does not affect processing that took place before.
• Security, rate limiting, preventing abuse and duplicate applications, keeping a limited record of applications and of the notice version, understanding which campaigns bring visitors through basic source tags, and answering your emails: our legitimate interests in running a safe and useful service (art. 6(1)(f)). You can object to this processing.
• Complying with legal obligations and establishing or defending legal claims: art. 6(1)(c) and art. 6(1)(f).

We do not sell personal data and do not use it for advertising profiles.

Personal data is available only to authorised Mazufa Records staff who need it and to service providers acting on our behalf:

• hosting and storage providers that run the website and keep the encrypted application record;
• email delivery services that send application notifications, our replies and, if you sign up, the newsletter;
• WhatsApp (Meta), only if you opt in to WhatsApp updates;
• Apple’s public music catalogue, which receives only the search term and only if you use the optional artist search;
• Google Fonts, only on older pages that still load its fonts;
• authorities, courts or professional advisers where the law requires it or where it is needed to establish, exercise or defend legal claims.

Our hosting and email providers may process application data in other countries. Where data-protection law requires it, those transfers are covered by appropriate safeguards, such as the European Commission’s Standard Contractual Clauses or an adequacy decision; you can ask for details at contact@mazufa.com.

If you use WhatsApp updates or the artist search, Meta and Apple process the data under their own terms, which may also involve other countries.

• Application record: stored encrypted and scheduled for deletion 90 days after submission. If you are accepted, the data needed for the relationship is kept under the terms provided with that relationship.
• Session measurement: up to 90 days.
• Newsletter: until you unsubscribe.
• Application draft: only in your browser tab, for up to two hours.
• Emails: as long as needed to deal with your message and any follow-up.
• Security, delivery, infrastructure and backup records: according to our providers’ cycles, or longer where reasonably necessary for security or legal reasons. We do not promise a specific backup-deletion date.

An automatic check confirms that the application is complete and eligible. A person reviews every application that passes, and you can ask for a person to review any automated decline at contact@mazufa.com.

The check looks at whether the required fields are filled in and valid (for example a usable email address, a recognised country or region, and a track title or catalogue link) and whether the application meets the basic eligibility requirements of the chosen path. If it does not, the application may be declined automatically. When you ask for a person to review a decline, you can explain your point of view and contest the decision, and a person then reviews the application and the decision.

Depending on the law that applies to you, you have the right to:

• access your personal data and receive a copy;
• have inaccurate data corrected;
• have your data erased;
• restrict processing;
• object to processing based on legitimate interests;
• receive the data you gave us in a portable format;
• withdraw your consent at any time;
• not be subject to a decision based solely on automated processing that significantly affects you, and obtain a review by a person (see “Automated checks”).

Send requests to contact@mazufa.com. We may need to confirm your identity before acting. We reply within one month, or within the time required by the law that applies to you. You also have the right to lodge a complaint with a data-protection supervisory authority, in particular in the country where you live, where you work or where you believe an infringement took place.

If you are under 18, a parent or legal guardian must apply with you. The website, the newsletter and measurement are not directed at children. If you believe a child has given us personal data without a parent or guardian, write to contact@mazufa.com and we will delete it.

This is notice version r26-privacy-2026-10-25, last updated on 25 October 2026. It replaces version r25-application-privacy-2026-09-19-v3, which covered the application form only. We record the version of this notice that applied when each application was submitted. If we change this notice, we will update this page and its version.