Legal changelog

Every material change to crate's legal documents is recorded here, newest first. Prior versions are preserved in the project's version history and are available on request (legal@hosaka.fm).

2026-07-02 (b) — triage-survivor refinements (all documents, still DRAFT)

Twenty-three verified refinements from the second-pass review triage, including: conspicuous (bold) data-quality disclaimer; purposive redistribution definition (substitutes-for-the-API test, replacing the undefined "bulk data dumps"); order-of-precedence + SCC-prevail carve-out; prospective-only changes to the disputes section; no-clearance-reliance and no-endorsement sentences; consumer-rights savings; retention correction (billing usage events are kept up to 90 days — the prior "~30 days" understated the billing stream; demand raw rows remain 30 days); strictly-necessary cookie statement; other-jurisdictions rights (AU/CA/BR/JP); Anthropic retention pointer + best-effort redaction description; DPA customer-obligations clause + assistance-cost note; sub-processor 30-day-notice alignment + Anthropic chain pointer; honest artist-name-personal-data framing replacing the blanket "about music, not people" claim.

2026-07-02 — global-robustness revision (all documents, still DRAFT)

  • Terms of Service: added the license grant (§ Data license) including the machine-learning boundary (internal training allowed; substitute products + weight redistribution not); IP-ownership; customer indemnity; rewrote Liability (conspicuous disclaimer, floor-of-$100 cap, non-excludable-rights savings incl. Australian Consumer Law); rewrote Governing law + disputes (Delaware law; binding individual arbitration with small-claims + IP-injunction carve-outs; class waiver); new Fees & taxes; Export controls & sanctions; Price changes; Free tier; Effects of termination (30-day export window); Beta features; Content complaints / takedown; General (boilerplate) sections; rewrote Data quality to disclose third-party rights in aggregated public-web content. Entity remains a placeholder pending formation.
  • Privacy Policy: definite retention rule for account/billing records (7 years post-closure); controller-identity block updated (entity placeholder + EEA/UK representative commitment); CCPA/CPRA business-status disclosure.
  • DPA: converted to self-serve auto-incorporation (no signature needed); EU SCCs (Module 2) + UK Addendum incorporated by reference with completed Annex I (processing details) + Annex II (technical + organizational measures); 72-hour breach-notice ceiling; 30-day deletion after termination; 30-day advance notice + termination right for sub-processor changes; dual-role clarification (processor for customer personal data; independent controller for crate's own service telemetry); CCPA service-provider certification.
  • Sub-processors: AWS row now enumerates the actual services and discloses CloudFront's global edge processing; SES clarified as an AWS service.
  • Funnel: signup now requires affirmative ToS/Privacy acceptance (checkbox; recorded with timestamp + version); Stripe Checkout collects Terms-of-Service consent on the hosted page.

2026-07-01 — initial drafts

  • First publication of the Terms of Service, Privacy Policy, Sub-processors list, and DPA at /legal/* (all marked DRAFT — pending legal review). Superseded the earlier draft terms at /docs/terms.