WAM Privacy Policy

• Version: 1.7
• Effective date: October 19, 2026
• Data controller: WAMMUSIC, LLC, a limited liability company organized under the laws of the State of Delaware, United States of America (“WAM”)
• Address: 7345 W Sand Lake Road, STE 210, Office 9326, Orlando, FL 32819, USA
• Privacy contact: [email protected]

1. Scope#

This Policy explains how WAM collects, uses, shares, retains and protects personal data when operating its mobile application, its web application (app.wammusic.com), its website (wammusic.com) and related services (the “Platform”). It applies to Artists, Contractors, applicants, representatives and anyone else who interacts with the Platform.

WAM operates internationally. We process data in accordance with this Policy and with the data protection laws applicable based on each person's place of residence, such as the European Union General Data Protection Regulation and its United Kingdom equivalent (GDPR), United States state privacy laws and Latin American data protection laws (for example, Uruguay's Law No. 18,331 or Argentina's Law No. 25,326). Where a local law grants greater protection than this Policy, that law prevails.

2. Controller and contact#

WAMMUSIC, LLC is the controller of the data described in this Policy. For any privacy question or request, write to [email protected]. Formal communications may also be sent to the address above.

3. Data we process#

3.1. Account and authentication#

Email address, password (at least 8 characters, stored only as a hash), role, language, account status, email confirmation date, email confirmation and password reset codes (stored as hashes and with an expiry), the provider and account identifier of your Google or Apple account when you choose to sign in with them (Google in the web app and in the mobile apps; Apple only in the iOS and Android apps; WAM does not store the name or photo of those accounts, and their email address is treated as confirmed), session tokens with their expiry date, and creation and update dates. The name shown on the Platform is the one you enter in your profile (sections 3.2 and 3.3).

When the account is created, and each time you accept a new version of the Terms or of this Policy, we record the acceptance: date and time, accepted version and the technical connection data received by our server (user agent and the device's IP address). We also record the date on which you confirmed being 18 or older.

3.2. Artist profile#

Stage and legal name, profile and cover photo (their own or one of the covers offered by WAM), short and long biography in Spanish and, if the Artist provides it, in English, country, languages, artist category and type, format, genres, instruments, voice type or range, repertoire, unavailable dates, media (photos, audio and video), professional preferences and conditions (also in both languages), whether the Artist has a manager and the manager's name, organization, email and phone number, and average rating and number of reviews.

The Artist's public profile (visible in search, in the feed and through the profile link) shows the stage name, photos, biographies, artistic data, repertoire, unavailable dates, public gallery files, the manager's name and organization, the average rating and the verification status. It never shows the phone number, legal and identity data, professional preferences and conditions, or the manager's email and phone number; the Platform offers no setting to display them. Preferences and conditions are seen only by the Artist and WAM administrators.

To verify identity and enable contracting, we may also process: identity document number, document type, expiry date, nationality, date of birth, legal address, phone number, images of the front and back of the document and a selfie holding the document. These data are not part of the public profile. However, the Artist's legal name, nationality, document number, legal address, phone number and email are included in the contract generated from the WAM template and are therefore seen by the Contractor of that contract (see section 7).

3.3. Contractor profile#

Organization name and type, country, city, phone number, years of activity, productions, team size, the organization's legal documentation, photo or logo, and details of the authorized representative (name, title, phone, email, document type, expiry date, images of the front and back of the document and a selfie holding the document). Where the Contractor provides them, billing details (name, email, address and tax identification). The Contractor's public profile shows the organization name and type, country, city, years of activity, productions, team size and photo or logo; phone numbers, documents, representative data and billing details are not part of the public profile. The Contractor's legal name, tax identification, address, city and country, representative's name and title, phone number and email are included in the contract generated from the WAM template and are seen by the Artist of that contract.

3.4. Content and activity#

Gallery photos, videos and audio (each file up to 50 MB, with the public or private visibility you choose for each one), feed posts, favorites, reviews and ratings, calls for artists, applications, in-app notifications and the list of Users you blocked, with the date of each block.

3.5. Communications#

Chat messages, attachments, delivery and read status, change requests and contract comments, and help or support requests (category, subject, description, status, messages, attachments and history), including the reports you send about other Users, which are handled as support tickets and state the reported person, the context (profile, chat or contract) and the reason. WAM does not use private conversations for advertising purposes. Sent messages cannot be edited or deleted in the app.

Chat is only available between verified Users and accepts image (JPG, PNG, WEBP or GIF), video (MP4, WEBM or MOV) or PDF attachments of up to 10 MB each. Each support request works as a conversation between you and the WAM team until WAM closes it, and accepts PDF, DOC, DOCX, JPG, PNG or WEBP attachments of up to 10 MB. When you open a request or reply in it, WAM receives an email alert (sent through Resend) with your name, your email address, the subject and the text of the message; when WAM replies or changes its status, you receive a notification.

WAM administrators can access conversations and their attachments where necessary to handle reports, investigate fraud or abuse, provide support or comply with the law. This access is limited to the administrator role.

3.6. Contracts and signatures#

Proposal and event data, generated or uploaded contracts, versions, comments, approvals, rejections, statuses, PDF files, a cryptographic hash of the contract PDF (for own contracts, of the signed PDF) and signature records. Signature evidence includes the signer's name, image of the handwritten stroke, date and time, role, contract version, acceptance of the payment and payout terms, the technical connection data received by our server (user agent and IP address) and signature hash.

3.7. Identity verification#

Verification status, submission and review dates, the administrator who decides, the reason for rejection where applicable (which is communicated to you in the app, by notification and by email) and, for the public presence search, the information described in section 3.8. The document and selfie are used for a document and visual review carried out by authorized WAM staff. WAM does not use automated document verification or facial recognition systems. An administrator may approve a profile even if it is not complete; in that case, the approval also marks the email address as confirmed.

3.8. Public professional presence search#

Only if the Artist or Contractor expressly authorizes it, every time they submit (or resubmit) their profile for verification WAM runs an internet search to help the review team check that the profile corresponds to a real professional activity. An administrator may also repeat it during the review, and if the search for a pending profile was interrupted, the system resumes it automatically.

• Up to six queries are sent to the Microsoft Bing search engine (through its public results page) using limited profile data: stage and legal name (Artist) or organization and representative name (Contractor), country, city (Contractor), artist type, genres and instruments, or organization type. Some queries are limited to professional sites and public social networks, such as LinkedIn, Instagram, Facebook or YouTube.
• The public titles, links and snippets obtained are sent, together with the same limited profile data, to the DeepSeek artificial intelligence service, which classifies them and produces a summary. DeepSeek processes and stores data in the People's Republic of China (see section 8).
• WAM retains the queries made, matching sources, warnings, a summary, the date and an indicative match score. Only WAM administrators can see them.

For this search we do not send document images, selfies, document numbers, addresses, phone numbers, emails or tax data. The score does not prove identity or honesty, does not replace human review, and the absence of public results is not in itself a reason for rejection.

The search is optional and off unless you authorize it: when you submit your verification (and from Settings → Edit profile) you can tick the box “I allow WAM to search the internet for public professional mentions of me (Microsoft Bing) and summarize them with AI (DeepSeek, China) to support the review”, which is shown unticked. WAM records the date of your authorization. If you do not tick it or you withdraw it, WAM runs no searches on your profile and immediately deletes the results already obtained; your verification is carried out using document and human review only, which may take longer. You can authorize or withdraw it whenever you wish. You can also provide context or ask for an incorrect match to be rectified by writing to [email protected].

3.9. Artificial intelligence: assistant and translation#

• AI assistant: when you choose to use it, the text you write and the history of that conversation are sent to the configured AI provider to generate the response. The current provider is DeepSeek (China); WAM may alternatively use Anthropic (USA), which is not currently in use. Your profile data are not sent. WAM does not store the assistant history in its database: it is kept only on your device while the screen is open. The assistant may suggest links to external services (for example, Uber, Uber Eats, Rappi, Airbnb or Booking.com) that include the trip details you wrote, such as destination or dates; if you open a link, those details reach that service, which processes them under its own policy.
• Biography translation: when a User views the profile of an Artist who has not provided their biography (short or long) in that User's language, the original biography is shown with a “Translate with AI” button. Only if the User taps it and expressly authorizes the transfer is the text of that public biography sent to DeepSeek to be translated. The translation is not stored: it is shown only during that visit, so the text may be sent again if it is requested again on later visits. To avoid this, the Artist can provide their biography in both Spanish and English.

Do not enter identity documents, financial data, health information, professional secrets or third-party data that you are not entitled to share into the assistant.

3.10. Device, security and diagnostics#

IP address, user agent, device type and operating system, push notification tokens (from the mobile app and, if you enable them in your browser, from the web app) with the corresponding platform, the content of notifications (which, for chat, includes the message text), audit and administrative action logs, server logs, technical errors and login attempts.

The app stores on your device (or in browser storage, in the web app) session tokens and preferences such as language or whether you have already seen the introduction. These data are necessary for operation and are not used for advertising.

To work, the app downloads technical resources from Google servers: the app's fonts (Google Fonts) and, in the web app, the app's graphics engine, the Firebase libraries for web notifications and, on the sign-in screen, the Sign in with Google button. When they are downloaded, Google receives the device's IP address and user agent. WAM does not use these services for analytics or advertising.

3.11. Payment and payout data#

• Artist payout details: to receive payments, the Artist registers a bank account: account holder, bank, bank country, account number or IBAN, SWIFT/BIC code and routing number (ABA) where applicable, currency and optional notes. We use them only to pay the Artist the fees for their contracts and to prevent fraud in those payments. They are private: only the Artist and WAM administrators can see them. They are not shown on the public profile, in search or to the other party to the contract.
• Movements: for each signed contract we record the amount payable, the platform fee, the payout option chosen by the Artist, advances and payments with their amounts, fees, dates, statuses and bank references, and the administrator who recorded each movement. For the Contractor's payment we also keep the originator details shown on the transfer received.
• Cards: WAM does not collect card details. Payments are not processed through Stripe or any other card payment processor: they are made by bank transfer.

4. Sources of data#

We obtain data directly from you; from your organization or representative; from other Users during an engagement, application, review or conversation; from Google or Apple when you use federated sign-in (email address and account identifier); automatically from your device and your use of the Platform; from the banks involved in a transfer (for example, the originator's name and the reference); and from public internet sources during the professional presence search.

If you provide data about another person (for example, your manager or representative), you confirm that you are authorized to do so and have informed them of this Policy.

5. Purposes and legal bases#

Where we rely on legitimate interest, we assess its necessity and proportionality against your rights, and you can object (section 11). We do not use your data for incompatible purposes without informing you and having a legal basis.

6. Mandatory or optional data#

Fields marked as mandatory are necessary to create the account, verify the profile, publish calls for artists or enter into contracts. If you do not provide them, those features may be limited, although you can explore the Platform with an incomplete profile. Optional fields are identified as such.

7. Who we share data with#

• Other Users: your professional profile data and the content you publish are visible to other Users and may be viewed by anyone accessing your profile link; the public content feed and published calls for artists can also be viewed without signing in; your phone number, your legal data and your manager's email and phone number are never shown on the public profile (sections 3.2 and 3.3). When you apply (only verified Artists can), your professional profile and your optional message are shared only with the Contractor who published the call. In an engagement, the other party accesses the contract and signature data, including the identification data that the WAM template includes in the contract (sections 3.2 and 3.3). Reviews left by a Contractor are shown on the Artist's public profile.
• Providers processing data on WAM's behalf:
  • OVHcloud (hosting of servers, database, files and backups; servers in the European Union, Italy).
  • Cloudflare (delivery and protection network for the public website wammusic.com, through which visits to that site pass; USA and worldwide network). The web app and the API do not pass through Cloudflare.
  • Google: Firebase Cloud Messaging (delivery of push notifications, including their content, in the mobile app and in the browser; USA), Google Sign-In (sign-in, if you choose it) and delivery of the app's technical resources (Google Fonts and, in the web app, the graphics engine and the Firebase libraries), described in section 3.10.
  • Apple (Sign in with Apple, if you choose it, only in the iOS and Android apps, and notifications on Apple devices).
  • Resend (delivery of operational emails; USA).
  • Sentry (error diagnostics for the server and the internal administration panel; USA).
  • DeepSeek (AI assistant, biography translation and analysis for the public presence search; People's Republic of China).
  • Anthropic (alternative AI assistant provider, not currently in use; USA).
  • Microsoft Bing (search engine queried in the public presence search; USA).
• External services you open: if you open a link suggested by the AI assistant (for example, Uber, Uber Eats, Rappi, Airbnb or Booking.com), that service receives the data included in the link and processes it as an independent controller.
• Banks: the Artist's payout details are shared only with the banks involved in the transfer (WAM's bank in the United States, intermediary banks and the Artist's bank), in order to send the payment. WAM does not use Stripe or any other card payment processor.
• Advisers and authorities: where necessary for professional advice, audit, defense of rights or compliance with a legal obligation or valid request.
• Corporate transactions: a potential acquirer or successor of the business, subject to confidentiality and to its respecting this Policy.

WAM does not sell personal data or share it for cross-context behavioral advertising. We do not display third-party advertising.

8. International transfers#

WAMMUSIC, LLC is a United States company, its main servers are located in the European Union and some providers process data in other countries, so your data may be transferred outside your country of residence, in particular to the United States and the People's Republic of China. Payments are sent from a bank in the United States, so the Artist's payout details are transferred to the United States and, where applicable, to the countries of the intermediary banks and of the Artist's bank.

Where required by applicable law, WAM uses valid transfer mechanisms, such as adequacy decisions (including the EU-US Data Privacy Framework for certified providers), standard contractual clauses or other recognized safeguards, and supplementary measures where appropriate.

Transfers to China (DeepSeek): China does not have a European Union adequacy decision nor, in general, one from Latin American authorities. The data sent to DeepSeek are limited to those described in sections 3.8 and 3.9 (assistant text, public biographies being translated and limited profile data with public search results), never documents, selfies, identification numbers, addresses, phone numbers, emails or tax data. You can avoid sending your messages by not using the assistant; biographies are only translated when the reader asks for it and authorizes it, and the Artist can avoid it by providing them in Spanish and English; and the public presence search only runs if you authorize it, and you can withdraw that authorization from your profile (section 3.8).

You can request information about the safeguards applied to each transfer by writing to [email protected].

9. Retention#

We retain data only for as long as necessary for the purposes described, to comply with legal obligations and to defend rights. We apply these criteria:

When the criterion is met, data are securely deleted or anonymized, unless they must be retained due to a legal obligation, litigation or investigation. When you delete the account from the app, the erasure and anonymization described in section 11 run immediately and automatically; requests received by email are handled manually.

Automatic daily backups of the database and files are kept for 14 days and then deleted automatically. One-off backups taken before technical changes may be kept longer and are deleted when no longer needed. All of them remain protected on WAM's servers.

10. Security#

WAM applies technical and organizational measures proportionate to the risk, including encryption in transit (HTTPS), passwords and codes stored as hashes, role-based access control, private storage of documents, contracts, signatures and chat and support attachments with authorized access through the API and temporary download links, audit logs and backups. Of the Artist's payout details, the account number or IBAN, the SWIFT/BIC code, the routing number (ABA) and the notes are stored encrypted in the database (AES-256-GCM, with an encryption key kept separate from the database and its backups); the account holder, the bank, the bank's country and the currency are stored unencrypted. All of them are accessible only to the Artist and WAM administrators, and the audit logs of changes to them keep only the last four digits of the account. The server's technical logs omit credentials (session tokens and cookies) before they are written. The IP address we record for legal acceptance, signatures and audit logs is that of the device performing the action.

Gallery files you mark as private are stored outside the public location and can be viewed only by their owner and WAM administrators, through signed links that expire within one to two hours; when a file goes from public to private, its previous public link stops working. Public gallery files and profile and cover photos are served from a public location: anyone who has their link can view them while they exist.

No system is invulnerable. In the event of a security incident affecting personal data, WAM will investigate, take mitigation measures and notify affected persons and competent authorities where required by law and within the legal deadlines (for example, 72 hours to the supervisory authority under the GDPR).

11. Your rights#

Depending on the law applicable to you, you may request:

• access to your data and a copy of it;
• rectification or updating;
• erasure (deletion);
• objection to processing based on legitimate interest;
• restriction of processing;
• portability of the data you provided to us;
• withdrawal of consent, without affecting the lawfulness of prior processing; and
• not to be subject to decisions based solely on automated processing with legal or similarly significant effects (WAM does not make such decisions; see section 12).

How to exercise them: write to [email protected] from the email address associated with your account, stating the right you wish to exercise. We may ask for reasonable information to verify your identity. We will respond within the period set by applicable law (for example, one month under the GDPR, extendable in complex cases, or any shorter period set by the law of your country). Exercising these rights is free of charge, except for manifestly unfounded or excessive requests where the law allows.

Account deletion: you can delete your account at any time from Settings → Delete account, typing the confirmation word and, if you sign in with a password, your password. Deletion is immediate and cannot be undone: all your sessions are closed, the profile stops being visible and we send you a confirmation email (“Your account was deleted”). At that moment we erase your profile (biographies, professional details, repertoire, availability, preferences, photo and cover), your gallery, your identity documents and verification data (including the results of the public presence search), your favorites, applications, notifications, blocks, payout details, device tokens and sessions, your email and credentials, and the attachments you sent by chat; the calls for artists you published are closed. We retain, without your profile data and linked to an anonymized account, the contracts you took part in with their versions and signature evidence, payment records, reviews, your support tickets and reports, and the legal acceptance and audit logs, for the periods in section 9. Your messages are shown to the other person as “deleted message”. If you can no longer access the app, write to [email protected] from the email address associated with the account; that request is handled manually and we will confirm the deletion by email. Administrator accounts are not deleted from the app.

Complaints to authorities: if you believe your rights have not been respected, you can lodge a complaint with the data protection authority of your country of residence, place of work or place of the alleged infringement (for example, the supervisory authority of your EU Member State, the UK Information Commissioner's Office or Uruguay's Unidad Reguladora y de Control de Datos Personales). We would appreciate the chance to resolve it first if you contact us.

Additional information for residents of US states#

If you reside in a US state with a comprehensive privacy law (for example, California, Colorado, Connecticut, Virginia or Texas) and that law applies to WAM, you may have the right to know and access your data, correct it, delete it, obtain a portable copy and opt out of the sale of data, its use for targeted advertising or profiling with significant effects. WAM does not sell personal data, does not share it for cross-context behavioral advertising and does not carry out such profiling. You can exercise your rights, directly or through an authorized agent, at [email protected]; if we deny a request, you can appeal by replying to our decision. We will not discriminate against you for exercising your rights.

12. Automated decisions#

WAM sorts and filters search results and generates the indicative public presence score described in section 3.8. No account is approved, rejected or sanctioned solely by automated means: those decisions are made by a person. You can request correction of the information, provide context and challenge the assessment before a person.

Responses from the AI assistant and automatic translations may contain errors and do not replace professional advice.

13. Minors#

WAM is not directed to persons under 18, who must not create accounts or upload their data. When creating the account, each User must expressly confirm being 18 or older by ticking a box, and we record the date of that confirmation; anyone who had not given it must do so when accepting a new version of the legal documents. If an Artist enters their date of birth, only dates corresponding to 18 years or more are accepted. WAM does not check age against documents at sign-up, but may do so during identity verification. If we learn that we are processing a minor's data, we will close the account and delete their data. You can let us know by writing to [email protected].

14. Device permissions#

The app may request access to the camera, photos, files and notifications solely to upload photos, media or documents, sign, attach files and receive alerts. You can manage permissions from the operating system; some features will stop being available.

15. Website and cookies#

The public website wammusic.com and the web app app.wammusic.com do not use cookies or tracking technologies for advertising or analytics purposes. Only cookies or local storage strictly necessary for operation, security and sign-in may be used, which do not require consent. The servers log technical data of each visit (such as IP address and user agent) for security and operational purposes.

Visits to the website pass through the Cloudflare network, which delivers them and protects them against attacks. When you use the Sign in with Google button in the web app, Google may use its own cookies under its privacy policy. The download of technical resources from Google servers is described in section 3.10. The website Cookie Policy gives more details.

If non-essential cookies are introduced in the future, this Policy will be updated and prior consent will be requested where required by law.

16. Changes to this Policy#

WAM may update this Policy due to legal, provider or feature changes. We will give reasonable advance notice of material changes and request your consent where a new purpose requires it. When this Policy or the Terms change, the app asks existing Users to accept the new version, showing a summary of the changes, before they keep using the main features (see Terms, section 23). The header shows the version and effective date; we keep previous versions to evidence what information each User received.

17. Contact#

For questions or to exercise your rights: [email protected]. Postal mail: WAMMUSIC, LLC, 7345 W Sand Lake Road, STE 210, Office 9326, Orlando, FL 32819, USA.

This is the same text shown inside the WAM app. Published on this site on October 19, 2026.