Privacy notice

• This website sets no advertising or analytics cookies. There is no Google Analytics, no advertising pixel, and no social plugin.
• Typefaces are served from this site’s own servers, so loading a page does not contact a font provider.
• Investor records and documents are stored on servers in Zürich, Switzerland. Notification email is sent through Google Workspace and is not confined to Switzerland.
• The one exception worth knowing: on Prism result pages, album artwork and artist photographs load straight from the open databases they belong to, which means those services see your IP address. Details are in Prism and open music databases.

The controller for the processing described here is MusicLy GmbH, Freihofstrasse 17, 8700 Küsnacht ZH, Switzerland, registered in the commercial register of the Canton of Zürich under CHE-249.986.367.

For anything in this notice, including a request to exercise your rights, write to [email protected]. MusicLy has not appointed a data protection officer; it is not required to.

Visiting this site

Each request leaves a server log entry: IP address, time, the page requested, referrer, and browser user-agent. It exists to keep the site available and to investigate abuse, and is not used to build a profile or identify you.

Writing to us

If you email MusicLy or use a contact link, the message and your address are kept so the enquiry can be answered and, where it leads to a business relationship, for as long as that relationship needs.

The investor portal

Access is by invitation only. The portal holds your name, email address, a cryptographic hash of your password (never the password itself), the secret behind your authenticator app, the entity you invest through, your holdings, the documents addressed to you, and an audit log recording sign-ins and views with the IP address they came from.

Prism

Searches are processed to return a result. Query terms appear in server logs; nothing is linked to a visitor and no search history is kept.

Where the GDPR applies, MusicLy relies on: performance of a contract and steps taken before entering one, for the investor portal and for enquiries (Article 6(1)(b)); legal obligations, including record keeping and anti-money-laundering duties (Article 6(1)(c)); and legitimate interests in operating a secure website and keeping an audit trail of access to investor information (Article 6(1)(f)). The Swiss Federal Act on Data Protection applies in parallel and does not require consent for any of the above.

Only what is strictly necessary, in the sense that removing it would break the site or its security:

Cloudflare security

Cloudflare sits in front of this site to absorb attacks and filter automated traffic. It may set a short-lived cookie such as __cf_bm to tell a person from a bot. It expires within the hour and is not used for advertising.

Your cookie choice

Your answer to the banner is kept in your browser’s local storage, not in a cookie, and never leaves your device. Clearing site data makes the banner appear again.

Investor portal session

Signing in to the portal sets an encrypted session cookie. It is required to stay signed in, expires after a period of inactivity, and is deleted when you sign out.

If MusicLy ever adds analytics, it will stay switched off unless you accept it on the banner. You can change your answer at any time from Cookie settings in the footer.

Prism looks up identifiers in MusicBrainz, the Cover Art Archive, Wikipedia by way of Wikidata, and Apple’s public catalog lookup. Those queries are made by MusicLy’s own server, so those services see a request from MusicLy, not from you.

Images are the exception. Album artwork and artist photographs are loaded by your browser directly from the Cover Art Archive (which redirects to the Internet Archive), from Wikimedia, and from Apple’s image servers. Those organizations therefore receive your IP address, your browser user-agent, and the fact that an image was requested. They are independent controllers for what they do with it, and each publishes its own privacy policy. MusicLy has no agreement with them and receives nothing back.

Google Cloud

Hosting and storage, in Google’s Zürich region. Website and portal data is stored there.

Cloudflare

Domain name service, certificate handling, and protection against attack. Traffic passes through Cloudflare’s network, which spans many countries, before reaching Zürich.

Email

Google Workspace, for notification email sent by the investor portal. Message content is handled on Google’s infrastructure and is not confined to the Zürich region.

These act on MusicLy’s instructions under data processing agreements. Personal data is never sold, and never shared for advertising.

Investor records and documents are stored in Switzerland, which the European Commission recognizes as offering an adequate level of protection, so transfers from the EEA need no further safeguard. Where traffic routes through Cloudflare infrastructure, or where notification email is handled by Google Workspace, outside Switzerland and the EEA, that is covered by the European Commission’s standard contractual clauses.

Server and security logs: up to 90 days. Enquiries: for the duration of the exchange and any relationship that follows. Investor records and the portal audit log: for the life of the investment and then for as long as Swiss commercial and anti-money-laundering law requires, which is generally ten years. Revoking someone’s access removes their ability to sign in immediately; it does not erase the audit trail, which the law requires MusicLy to keep.

You may ask for a copy of the personal data MusicLy holds about you, ask for it to be corrected or deleted, ask that processing be restricted, object to processing based on legitimate interests, and ask to receive data you provided in a portable form. Where processing rests on consent, you may withdraw it at any time without affecting what came before.

Write to [email protected]. MusicLy answers within 30 days and may ask you to confirm your identity first, so that an account is never disclosed to someone else.

If you are not satisfied, you may complain to the Swiss Federal Data Protection and Information Commissioner, or, in the EEA, to the supervisory authority where you live or work.

The site and the portal are served only over encrypted connections. Portal passwords are stored as salted scrypt hashes and every account carries a second factor. Access to investor information is decided on the server for every request and is scoped to the holdings addressed to that investor. Every sign-in and every document download is recorded in the audit log. You can reach the portal at portal.musicly.ch.

This notice will change as MusicLy does. The date at the top always reflects the current version, and material changes will be signaled to portal users when they next sign in.