Privacy Policy

1. Scope

This Privacy Policy applies to personal data processed by X2 Records in connection with X2 accounts, websites, professional verification, catalog and rights services, distribution, analytics, APIs, payments, support, Label activity and other X2 Services.

2. Controller and Processor Roles

X2 may act as an independent controller for account administration, security, billing, fraud prevention, compliance and its own service operations.

For certain business-customer workflows, X2 may process personal data on documented customer instructions as a processor under an applicable Data Processing Agreement.

3. Data We Process

Data may include account and contact information, professional roles and identifiers, identity or business-verification results, rights and catalog information, payment and tax information, connected-account data, technical logs, API activity, support communications, security events and service usage.

4. Purposes

X2 processes data to provide and secure services, authenticate users, verify identity and professional roles, manage rights and catalog records, deliver content, reconcile revenue, process payouts, provide analytics, prevent fraud, respond to claims, support users, comply with law and improve service reliability.

5. Legal Bases

Depending on the context, processing may be based on performance of a contract, legitimate interests, compliance with legal obligations, consent or another lawful basis available under applicable data-protection law.

6. Professional and Rights Verification

Verification may use professional identifiers, institutional records, documents, public professional information, rights evidence and manual review. Identity verification, role verification and rights verification remain separate.

7. Financial and Payout Data

Payment and beneficiary data may be processed by X2 and specialized financial providers. X2 may retain only verification results or references where full document storage is unnecessary.

8. Connected Services

Users may authorize connections to DSPs, social platforms, advertising systems, rights organizations, analytics providers and other supported services using OAuth, APIs or other authorized methods. X2 does not require third-party passwords where provider-authorized connection methods are available.

9. Analytics, Audience and Marketing Data

Where authorized, X2 may process performance, audience, campaign and related data to provide analytics and professional workflows. Availability and precision depend on source platforms and provider permissions.

10. AI and Automation

X2 may use automation and AI to classify, validate, detect anomalies, support rights and fraud review, analyze content or assist service operations. Material decisions may be subject to additional review where required or appropriate.

X2 does not automatically use customer catalogs for AI-model training. Any future training-licensing program would require explicit opt-in and separate terms.

11. Sharing

Personal data may be shared with authorized customer personnel, service providers, financial providers, distribution partners, connected services, professional registries or authorities where necessary for the requested service, legal compliance, security or rights protection.

X2 does not sell personal data for monetary consideration. Some laws may define certain advertising or data-sharing activities differently; where applicable, X2 will provide required disclosures and controls.

12. International Transfers

Data may be processed across jurisdictions where X2, customers or providers operate. X2 uses appropriate contractual, organizational or legal safeguards where required for international transfers.

13. Retention

Retention depends on service, contractual, rights, accounting, tax, security, fraud and legal requirements. Rights history, financial records and fraud evidence may need to be retained after account closure.

14. Security

X2 uses reasonable technical and organizational measures to protect personal data, including access controls, authentication, logging and service-specific security controls. No system can guarantee absolute security.

15. Individual Rights

Depending on applicable law, individuals may have rights of access, rectification, erasure, restriction, portability, objection, consent withdrawal and complaint to a competent supervisory authority. Certain records may be retained where X2 has a lawful reason to do so.

16. Automated Decisions

Where a decision produces legal or similarly significant effects and applicable law grants rights regarding automated decision-making, X2 will provide the protections required by that law. Automated flags or detectors may be used as review signals without being treated automatically as final findings.

17. Business Customers

Business customers are responsible for ensuring that personal data they submit to X2 is collected and instructed lawfully. X2 remains responsible for its own processing, security and legal obligations.

18. Marketing Communications

Where permitted, X2 may send service and marketing communications. Users can manage marketing preferences or unsubscribe from non-essential marketing messages. Essential service, security and legal communications may still be sent.

19. Minors

X2 professional services are not intended for persons who lack legal capacity to enter into the applicable agreement without any consent required by law.

20. Changes and Corporate Events

Data may be transferred as part of a lawful merger, acquisition, restructuring or similar transaction, subject to applicable safeguards. X2 may update this Policy as services and laws change.

21. Contact

Privacy questions and requests: privacy@x2records.com. Legal matters: legal@x2records.com.