Privacy Policy

Status: DRAFT — pending legal review. This is an engineering-grounded starting draft reflecting crate's actual data flows; the language must be reviewed by counsel and an effective date set before any paying customer is onboarded.

Last updated: 2026-07-01 (draft) · Effective date: TBD

This policy explains how Hosaka ("we", "us") — operating the crate-api at crate.hosaka.fm — handles personal data about you, our customer. It does not describe the music-catalogue data the API returns: that catalogue is primarily data about musical works and releases, though it includes artist names and public professional information (which may be personal data in some contexts). Artists with questions or objections about their data can email privacy@hosaka.fm or use the content-complaints channel in the Terms §19. This policy covers the personal data we collect to run the business: your account, your billing, and your technical usage.

1. Who we are + how to reach us

crate-api is operated by [ENTITY — to be completed on formation: a Delaware limited liability company; registered address to be listed here] ("Hosaka"), the controller of the personal data described in this policy. For privacy questions, data-subject requests, or to reach our data contact: privacy@hosaka.fm (or legal@hosaka.fm, or by post to the registered address above once listed). We have not appointed a DPO (not currently required at our size). EEA/UK: before we make the service generally available to EEA/UK customers we will appoint (and name here) an Article-27 EU representative and a UK representative, unless our processing remains within the occasional/low-risk exemption; until then, contact privacy@hosaka.fm directly.

Last updated: 2026-07-02 (draft) — changes are recorded in the legal changelog.

2. What we collect

| Category | Data | Source | |---|---|---| | Account | Email address; optional display name; a hashed customer identifier | You, at signup | | Billing | Subscription tier, status, invoices. We do not store your card number — payment details are handled by Stripe (our payment processor). | You, via Stripe Checkout | | Technical / usage | Per-request logs: your API key id + customer id, the endpoint called, HTTP status, latency, and timestamp; source IP address (for rate-limiting + abuse prevention) | Automatically, when you call the API | | Demand signal | Aggregate counts of which catalogue entities were requested; on an unmatched name lookup, the searched artist name (a music-entity string). Raw rows are pruned after 30 days; only frequency aggregates persist. | Automatically | | Cookies | A single first-party session cookie (__crate_session) that keeps you signed in to the dashboard. It is strictly necessary for authentication, so no consent banner is required under ePrivacy/PECR. We set no third-party or advertising cookies, run no third-party analytics/tracking, and use no localStorage/sessionStorage tracking. | Dashboard login |

We do not collect special-category data, and we do not buy personal data about you from third parties.

3. Why we use it + legal basis (GDPR Art. 6)

  • To provide the service (issue keys, authenticate, meter usage, bill you) — performance of a contract.
  • Security, rate-limiting, abuse + fraud prevention (IP, usage logs) — legitimate interests.
  • Billing, tax + accounting records — legal obligation.
  • Service transactional email (magic-link sign-in, billing notices) — performance of a contract. We do not send marketing email without consent.

4. AI features — opt-in, and separate from the base product

The base crate-api uses no AI to process your requests. Faceted search, dossiers, and enrichment are deterministic database queries — your query data is not sent to any AI provider.

Two optional, opt-in features use a third-party AI model (Anthropic Claude):

  • Natural-language search (GET /api/v1/search?nl=true) — interprets a free-text query into structured facets.
  • Wayfind (/api/v1/wayfind/*) — synthesizes a natural-language answer.

When (and only when) you invoke these features, the text of your query is sent to Anthropic for processing. We apply the following safeguards:

  • PII redaction + injection filtering run before the text leaves crate. The redaction is automated and best-effort — do not include personal data in queries you are not entitled to process.
  • We do not persist your raw query text — our telemetry stores only a one-way hash (fingerprint) of the query, not the text itself.
  • Anthropic does not train its models on data submitted through its commercial API (per Anthropic's commercial terms); the data is used only to return your result, and any Anthropic-side retention (e.g. limited abuse-monitoring windows) is governed by Anthropic's commercial terms and privacy documentation.

If you never use ?nl=true or the wayfind endpoints, no data about your requests reaches any AI provider. Operators may disable these features entirely for their deployment.

AI output is probabilistic. NL interpretations and wayfind answers are generated by a model and may be inaccurate or incomplete; they are a convenience layer over the deterministic API, not a warranted result. Do not rely on them as the sole basis for a decision.

5. Who we share it with (sub-processors)

We share personal data only with the infrastructure providers needed to run the service — our sub-processors (Amazon Web Services, Stripe, Anthropic [AI features only], Amazon SES). We do not sell your personal data, and we do not share it for advertising. See the sub-processor list for each provider's role, data, and location.

6. How long we keep it

  • Raw per-request logs: billing-grade usage events are kept up to 90 days, demand-signal raw rows up to 30 days, and application logs up to 7 days — each then pruned; only anonymized frequency aggregates persist beyond those windows.
  • Account + billing records: retained while your account is active. After account closure, billing, invoice, and tax-relevant records are retained for 7 years (US tax + accounting requirements), then securely deleted. Account records with no such retention obligation are deleted within 90 days of closure.
  • ToS-acceptance records (timestamp + version accepted at signup): retained for the life of the account plus the same 7-year post-closure period (they evidence the contract).
  • Session cookie: up to 30 days, or until sign-out.

You may request deletion at any time (see §8); we will delete everything not subject to a legal retention obligation and tell you what (if anything) must be retained and until when.

7. International transfers

crate is hosted in the United States (AWS us-east-1). If you are in the EEA/UK, your personal data is transferred to the US; where required we rely on the EU Standard Contractual Clauses (and the UK Addendum) via our sub-processors' data-processing terms.

8. Your rights

Depending on where you live, you have rights to access, correct, delete, restrict, port, or object to the processing of your personal data (GDPR/UK GDPR), and to know, delete, correct, and opt out of "sale"/"sharing" (CCPA/CPRA — note we do not sell or share your data, and we do not use sensitive personal information beyond what §2 lists). We honor these requests for everyone regardless of whether a given law's thresholds technically apply to us (as an early-stage business we may fall below CCPA's applicability thresholds; we follow it anyway). If you are in Australia (Privacy Act/APPs), Canada (PIPEDA), Brazil (LGPD), Japan (APPI), or another jurisdiction with equivalent rights, we honor the same access/correction/deletion requests through the same channel. To exercise any right, email privacy@hosaka.fm; we will respond within the timeframe the applicable law requires (30 days under GDPR, 45 under CCPA, extendable as those laws allow). We will not discriminate against you for exercising a right. You may also lodge a complaint with your local supervisory authority.

9. Security

Data is encrypted in transit (TLS) and at rest (databases, object storage, and backups — the full measure list is the DPA's Annex II). API keys are stored only as salted hashes (the plaintext is shown once at creation and never stored). Access to production data is least-privilege. If a breach affects your personal data, we will notify you and any required authority without undue delay (and within 72 hours where GDPR applies).

10. Children

crate-api is a business-to-business developer product not directed to children. You must be at least 18 and using the service for a business or professional purpose.

11. Changes

We will post changes here (recorded in the legal changelog) and notify account holders by email. For changes that materially expand what we collect, why we process it, or who we share it with, we will give at least 30 days' advance notice and, where the law requires consent, obtain your affirmative re-acceptance before the change applies to you. Clarifications and privacy-improving changes may take effect with shorter notice; continued use after the effective date of such a change constitutes acceptance.

Contact: privacy@hosaka.fm (privacy + data-subject requests) · legal@hosaka.fm (legal) · support@hosaka.fm (everything else). See also our Terms of Service, Sub-processors, and DPA.