Legal

Privacy Policy

Effective date: November 5, 2026Last updated: November 5, 2026

Draft for legal review. This document describes what Lisnin does today and is awaiting review by our lawyer. Items marked [Matt to confirm] are not yet verified.

This Privacy Policy explains what personal information Lisnin Music Inc. (“Lisnin”, “we”, “us”) collects through www.lisnin.io and the forms on it, why we collect it, who we share it with and the choices you have. The Lisnin Listening Party Discord bot has its own, more detailed policy: Listening Party Privacy Policy.

1. Who we are and who to contact

The website and the Lisnin platform are operated by Lisnin Music Inc., a federal corporation under the laws of Canada, with its mailing address at 949 Sprague Pl, Milton, Ontario L9T 0K6, Canada. We are the organization responsible for the personal information described in this Policy.

Privacy Officer: [Matt to confirm: name the person who holds the Privacy Officer role], Lisnin Music Inc.. Email hello@lisnin.io or write to the mailing address above. Please put “Privacy” in the subject line.

2. What we collect, form by form

We collect only what each form asks for, plus a small amount of technical data (next section). This table reflects how the site works today.

Where	What you give us	What happens to it
Contact form	Name, email, inquiry type, whether you are an artist, brand or label, and your message.	Sent by email (through Resend) to our team inbox at hello@lisnin.io, and we send you an automatic reply. It is not saved in our lead database; it lives in our email.
Beta waitlist	Name and email.	Saved to a table in our Microsoft Azure storage with a timestamp, emailed to our team, and used to send you a confirmation and launch updates.
Book a call	Name, email, preferred date and time, and the page you booked from.	Sent by email (through Resend) to our team, and we send you an automatic reply.
Founding Member checkout	The artist name in your invitation link, and, on Stripe's secure checkout page, your email, name, billing details and card details.	Stripe processes the payment. We receive the payment record (amount, email, artist name, the fact that you accepted the Founding Member terms) from Stripe. We never see or store your full card number. Our server does not save a separate copy in our lead database.
Listening Party: community admin form	Name, email, community name, optionally your Discord server ID, whether you accepted the Listening Party terms and (separately) whether you opted in to marketing email.	Saved to a table in our Azure storage along with the exact consent wording you saw, the time, and the first 300 characters of your browser's user-agent string as a record of consent. We email you a welcome message and notify our team.
Listening Party: member form	Optionally your email and your Discord server ID, whether you accepted the terms and whether you opted in to marketing email.	Saved to a table in our Azure storage with a random reference ID, the consent wording, the time and your user-agent string. The reference ID links this record to the Discord account you then authorize.
Listening Party: Discord authorization	When you approve the Lisnin bot on Discord we receive your Discord user ID, username, email, and your server's ID and name. For members, the Spotify listening activity you share in your Discord status.	Handled by the Listening Party service. See the Listening Party Privacy Policy for the full list, including points and any stored authorization tokens [Matt to confirm: what the Discord backend stores].
Emailing us directly	Your email address and whatever you write.	Kept in our email system (Google Workspace) so we can reply.

You do not have to give us any of this, but without it we cannot provide the related feature (for example, we cannot add you to the waitlist without an email address).

3. Information collected automatically

When you visit the site, our servers and hosting providers receive your IP address, browser and device type, the page requested and the time. We use your IP address briefly to limit abuse (for example, to cap how many times one address can submit a form) and for security.

If you accept analytics cookies, Microsoft Clarity also records how you use the pages: clicks, scrolling, mouse movement and page views, with device, browser and approximate location. See Cookies below and our Cookie Policy.

Fonts on this site are bundled with the site itself; your browser does not contact Google Fonts when you load our pages. [Matt to confirm: check any third-party fonts or scripts on /i/bizintro]

4. Why we use it, and our legal basis

We use personal information only for the purposes below. If you are in the EEA or UK, the legal basis (GDPR / UK GDPR) is shown beside each one. In Canada we rely on your consent, which may be implied where the use is obvious from why you gave us the information.

Purpose	Legal basis
Reply to your message or call request	Legitimate interests (answering people who contact us); steps you ask for before a contract
Run the beta waitlist and tell you when Lisnin launches	Consent
Take and process a Founding Member payment, issue receipts, handle refunds	Contract; legal obligation (tax and accounting records)
Run Listening Party: connect Discord, track points, award prizes	Contract (the Listening Party terms); consent where you opt in
Send you news, music and offers by email	Consent (opt-in; withdraw any time)
Understand how the site is used and improve it (analytics)	Consent (analytics cookies are off until you accept)
Show and measure ads, once our ads are live (marketing cookies)	Consent (off until you accept)
Keep the site secure, prevent spam and fraud, rate-limit forms	Legitimate interests
Keep records of consent, handle disputes, meet legal duties	Legal obligation; legitimate interests

We do not sell your personal information and we do not use it for automated decisions that significantly affect you.

5. Cookies and similar technologies

We group cookies and similar technologies into three categories, matching the choices in our cookie banner:

Necessary: needed for the site to work (for example, remembering your theme and your cookie choice). Always on.
Analytics: Microsoft Clarity (session recordings and heatmaps) and Google Analytics 4. Off unless you accept.
Marketing: Meta Pixel, Google Ads and TikTok Pixel. These are used only if you opt in, once our ads are live. Off unless you accept.

The full list, with what each one does and how long it lasts, is in the Cookie Policy. You can change your choice at any time with (also in the footer of every page).

We share personal information only with the service providers (“processors”) that help us run the site and the platform, under contracts that limit how they may use it. These are the providers we have verified in our code today:

Provider	What it does for us	Data involved
Microsoft Azure (Azure Container Apps, Front Door, Table Storage)	Hosts the site, filters traffic, and stores waitlist and Listening Party records	Form submissions listed above; IP addresses and request data in hosting logs
Resend	Sends our email (confirmations, replies, notifications)	Names and email addresses; message contents
Stripe	Takes payment for Founding Membership	Name, email, billing and card details, artist name
Discord	Sign-in and authorization for Listening Party; where the bot runs	Discord user ID, username, email, server details
Spotify	Source of listening activity for Listening Party (via Discord, and where you authorize Spotify directly)	Listening activity and, if you authorize it, Spotify account data
Microsoft Clarity	Site analytics: session recordings and heatmaps (if you accept analytics)	Usage and device data, pseudonymous identifiers
Google (Workspace)	Our team email and documents	Anything you email us
Google Analytics 4, Meta, Google Ads, TikTok	Analytics and advertising, only once enabled and only if you opt in	Usage and device data, cookie identifiers; hashed email for ad matching if you submit a form (Meta)

Other vendors. [Matt to confirm vendor list] Our records suggest we may also use or plan to use HubSpot, Emergent, ManyChat, Eveara, Soundcharts and ElevenLabs. None of these appear in this website's code, so we have not described what data they receive. Matt to confirm which are live, what personal information each handles, and where, then move them into the table above.

We may also disclose information when the law requires it (for example, a court order), to protect people's safety or our rights, or to a successor if Lisnin is involved in a merger, financing or sale, who would be bound by this Policy.

7. Where your information is stored and sent

Our Azure storage is located in Canada [Matt to confirm: Azure region of the Table Storage account and container apps]. Several providers above, including Resend, Stripe, Discord, Google, Meta and Microsoft Clarity, process data in the United States and possibly other countries. Our development team may also access data from outside Canada [Matt to confirm: countries, e.g. India]. Your information may therefore be subject to the laws of those places, including access by their courts and authorities.

For people in the EEA and UK, transfers to countries without an adequacy decision rely on the provider's standard contractual clauses or equivalent safeguards. For Quebec residents, we assess privacy risks before transferring personal information outside Quebec, and we document those transfers as Quebec's Law 25 requires; ask us if you want to know more. [Matt to confirm: privacy impact assessment completed]

8. How long we keep it

Information	Proposed retention
Waitlist (name, email)	Until you unsubscribe or ask us to delete it, or 24 months after launch if you never become a customer
Contact and book-a-call messages	24 months after the last message, then deleted
Payment and refund records (Founding Member)	7 years, to meet tax and accounting rules
Consent records (wording, time, version)	For as long as the related record exists, plus 3 years as proof of consent
Listening Party admin and server data	While the bot is in the server, and deleted or anonymized within 90 days after it is removed (this is already stated in the Listening Party policy)
Listening Party member data	24 months after your last activity, or sooner if you ask us to delete it
Analytics (Clarity, GA4)	Per the provider's setting, proposed maximum 13 months
Server and security logs	Up to 90 days

Aggregated statistics that do not identify anyone may be kept longer. We may keep information longer where the law requires it or where it is needed to resolve a dispute.

9. Your rights and how to use them

Depending on where you live, you can ask us to:

tell you what personal information we hold about you and give you a copy (access);
correct information that is wrong or incomplete;
delete your information, or restrict or object to how we use it;
give you your information in a portable format;
withdraw consent at any time (for marketing email, use the unsubscribe link; for cookies, use cookie settings). Withdrawing does not affect what we did before.

EEA and UK residents have the rights above under the GDPR and UK GDPR, including the right to object to processing based on legitimate interests. California residents have the right to know, delete, correct, and opt out of the sale or sharing of personal information, and to not be discriminated against for using these rights, under the CCPA/CPRA. We do not sell personal information for money. Some advertising cookies can count as “sharing” for cross-context behavioural advertising under California law; they are off unless you opt in.

To use any right, email hello@lisnin.io with “Privacy request” in the subject. We may ask you to confirm who you are first. We aim to answer within 30 days (the time allowed by Canadian law, GDPR and CCPA is generally 30 to 45 days). An authorized agent may make a request for you with your written permission.

Complaints. Please contact us first so we can fix the problem. You can also complain to the Office of the Privacy Commissioner of Canada, to the Commission d'accès à l'information du Québec if you live in Quebec, or to your local data protection authority in the EEA or UK (in the UK, the Information Commissioner's Office).

10. Your Privacy Choices

You control tracking on this site in two ways.

1. Cookie settings. Choose which categories to allow, or change your mind later: .

2. Global Privacy Control (GPC). If your browser or an extension sends a Global Privacy Control signal, we treat it as a request to opt out of the sale or sharing of your personal information, and as a refusal of analytics and marketing cookies. [Matt to confirm: GPC handling is implemented in the consent banner] Learn more at globalprivacycontrol.org.

Do not sell or share my personal information. Marketing cookies are off by default and only run if you opt in. To opt out of any sale or sharing, leave Marketing off in cookie settings, send a GPC signal, or email hello@lisnin.io.

11. Security and breaches

We protect personal information with safeguards that fit how sensitive it is, including encryption in transit (HTTPS), access limited to people who need it, rate limiting and bot protection on forms, and a managed cloud provider. No system is perfectly secure.

If a breach of security safeguards involves personal information and creates a real risk of significant harm, we will report it to the Office of the Privacy Commissioner of Canada and notify affected people as soon as feasible, as PIPEDA requires, tell any other regulator the law requires (including EU/UK authorities within 72 hours where the GDPR applies), and keep a record of every breach.

12. Children and minimum age

The Lisnin website and platform are for people 16 and older. The Listening Party Discord bot is for people who meet Discord's own minimum age (13 in most countries, higher in some). We do not knowingly collect personal information from anyone under 13, or from anyone under the minimum age that applies to them. If you think a child has given us information, email hello@lisnin.io and we will delete it.

13. Commercial email (CASL)

We send marketing email only with your consent, which is separate from consent to the Terms, and every commercial message names Lisnin Music Inc., gives our mailing address and contact details, and has an unsubscribe link that works for at least 60 days. Service messages, such as a receipt, a reply to your question or setup information, are not marketing. To stop marketing email, click unsubscribe or email hello@lisnin.io; we will act within 10 business days.

[Matt to confirm: the beta waitlist and contact forms currently treat submission as consent to marketing. Under CASL, express consent should be a separate, unticked checkbox with the wording used on the Listening Party forms.]

14. Changes to this Policy

We may update this Policy. We will change the “Last updated” date above and, for material changes, tell you by email or a notice on the site. Related documents: Terms of Service, Cookie Policy, Listening Party Terms.

15. Contact us

Lisnin Music Inc., Privacy Officer
949 Sprague Pl, Milton, Ontario L9T 0K6, Canada
Email: hello@lisnin.io