Privacy Policy and Data Disclosure

1. Introduction and Who We Are

Welcome to WavCash (the “Platform”, “we”, “us”, or “our”). The Platform is operated by Sama Studios LLC, a New Mexico limited liability company.

We provide tools for music creators, songwriters, producers, and collaborators to create, sign, and manage music royalty split sheet agreements and related documents.

Data Controller: Sama Studios LLC is the data controller for all personal information processed through the Platform.

Contact:

• Email: privacy@wav.cash
• Data rights requests: privacy@wav.cash
• Formulario web: wav.cash/data-request

EU/EEA Establishment: Sama Studios LLC is established in the EU by virtue of operating from Portugal. No separate EU representative is required under Article 27 GDPR. Privacy inquiries may be directed to privacy@wav.cash.

UK Representative (UK GDPR): Sama Studios LLC does not currently have a designated UK representative. If you are a UK resident with a privacy inquiry or complaint, please contact privacy@wav.cash. We are in the process of appointing a formal UK representative as required under UK GDPR Article 27 and will update this Policy when that appointment is made.

Data Protection Officer: Sama Studios LLC has not appointed a formal DPO as we do not currently meet the mandatory appointment thresholds under Article 37 GDPR. Privacy inquiries may be directed to privacy@wav.cash.

2. Scope of This Policy

This Privacy Policy applies to:

• All users who access or use the Platform, including free and paid accounts
• Visitors to our website at https://wav.cash
• All personal information submitted in connection with creating, viewing, signing, or managing agreements on the Platform
• Third parties whose personal information is submitted by a Platform user, for example a co-writer added to a split sheet by another user

If you are a third party whose information has been submitted to the Platform by another user, please contact us at privacy@wav.cash to exercise your data rights.

This Policy does not apply to third-party websites or services linked from the Platform.

3. What Personal Information We Collect

We collect the following categories of personal information.

3.1 Information You Provide Directly

Identity Information:

• Full legal name
• Stage name or artist alias

Contact Information:

• Email address
• Mailing address
• Phone number, if provided

Professional and Music Industry Information:

• Performing Rights Organization affiliation, such as ASCAP, BMI, SESAC, SOCAN, or PRS
• IPI or CAE number
• Publishing company name
• Role on musical works, such as songwriter or producer
• ISRC and ISWC codes associated with works

Agreement Content:

• Ownership percentages and royalty splits entered into agreements
• Digital signatures, including name, timestamp, and IP address at time of signing
• Agreement dates and identifiers

Account Information:

• Username and password stored in hashed and encrypted form
• Account preferences and settings

3.2 Information Collected Automatically

When you use the Platform, we automatically collect:

• IP address
• Browser type and version
• Operating system
• Device identifiers
• Pages visited and features used
• Time and date of access
• Referring URL
• Session duration

We use Google Analytics for usage analytics. Google Analytics may set cookies on your device. You can opt out of Google Analytics across all websites using the Google Analytics Opt-out Browser Add-on. See Section 8 for further detail on cookies and how to manage them.

3.3 Information From Third Parties

We may receive personal information about you from:

• Other Platform users who add you as a collaborator or co-signatory on an agreement
• PROs or music industry databases, if you choose to connect such services

3.4 Special Categories of Data

We do not intentionally collect data revealing racial or ethnic origin, political opinions, religious beliefs, health or medical data, biometric identification data, sexual orientation, or government-issued identification numbers such as Social Security Numbers or Tax IDs.

If you believe sensitive data has been inadvertently submitted to the Platform, contact us at privacy@wav.cash and we will delete it promptly.

4. Why We Collect Your Data and Our Legal Basis

For each purpose we process your data, we rely on one of the following legal bases under GDPR.

We do not sell your personal information. We do not share your personal information with third parties for their independent marketing purposes.

5. How Long We Retain Your Data

We retain personal information only for as long as necessary for the purpose for which it was collected, subject to applicable legal retention requirements.

When retention periods expire, data is deleted or anonymized in a way that prevents reconstruction. You may request early deletion subject to the exceptions described in Section 7.

6. How We Share Your Data

We share your personal information only in the following circumstances.

6.1 With Co-Signatories on Your Agreements

When you create a split sheet agreement and add other parties, those parties will receive an invitation containing your name and contact information to facilitate the agreement process. This sharing is necessary to perform the contract.

6.2 With Service Providers (Data Processors)

We work with vetted third-party service providers who process data on our behalf under written Data Processing Agreements. Our current service providers include:

Our service providers are contractually prohibited from using your data for their own purposes.

6.3 Legal Compliance and Protection

We may disclose personal information if we believe in good faith that such disclosure is necessary to:

• Comply with applicable law, regulation, or legal process, including valid court orders or subpoenas
• Enforce our Terms of Service
• Protect the rights, property, or safety of Sama Studios LLC, our users, or the public
• Detect, prevent, or respond to fraud, security incidents, or technical issues

6.4 Business Transfers

If we are involved in a merger, acquisition, asset sale, or bankruptcy, your personal information may be transferred as part of that transaction. We will notify you by email or prominent notice on the Platform before your personal information becomes subject to a materially different privacy policy.

6.5 With Your Explicit Consent

We will share your information with any other party only with your explicit prior consent.

7. Your Privacy Rights

Depending on where you are located, you may have the following rights regarding your personal information. We honor these rights regardless of jurisdiction and treat them as universal to the extent technically feasible.

Right to Know and Access: You may request a copy of the personal information we hold about you, including what categories we hold, how we use it, and who we share it with.

Right to Correction and Rectification: You may request that we correct inaccurate or incomplete personal information.

Right to Erasure and Deletion: You may request that we delete your personal information. We will fulfill this request unless retention is required by law. Signed split sheet agreements may be subject to contractual and legal retention obligations.

Right to Portability: You may request your personal information in a structured, machine-readable format such as JSON or CSV.

Right to Restrict Processing: You may request that we temporarily limit processing of your data while you contest its accuracy or our legal basis.

Right to Object: You may object to processing based on legitimate interests or for direct marketing purposes.

Right to Opt Out of Sale or Sharing: We do not sell or share your personal information as defined under the CCPA or CPRA.

Right to Non-Discrimination: Exercising any privacy right will not result in denial of service or reduced quality of service.

How to Submit a Request

Submit any rights request through:

• Email: privacy@wav.cash
• Formulario web: wav.cash/data-request

We will respond within 30 days, extendable to 60 days for complex requests with notice. We may need to verify your identity before processing certain requests.

For EU and UK residents, you also have the right to lodge a complaint with your local supervisory authority at any time.

8. Cookies and Tracking Technologies

We use the following types of cookies and similar technologies.

You can manage cookie preferences using the cookie consent banner that appears when you first visit the Platform. To reset your preferences, clear your browser's local storage for wav.cash.

For EU and UK users, we will not set non-essential cookies without your prior consent. You may withdraw consent at any time by clearing your browser's local storage for wav.cash.

Global Privacy Control (GPC): We honor browser-level Global Privacy Control signals as an opt-out of data sharing where required by law.

Google Analytics: We use Google Analytics to understand how users interact with the Platform. The data is aggregated and anonymized.

9. International Data Transfers

Your personal information may be transferred to and processed in countries other than your country of residence. These countries may have different data protection laws.

When transferring personal information outside the EU, EEA, or UK, we implement safeguards including Standard Contractual Clauses, UK International Data Transfer Agreements where applicable, and adequacy decisions where available.

10. Security

We implement technical and organizational measures appropriate to the risk level of the data we process, including:

• AES-256 encryption for data at rest
• TLS 1.2 or higher encryption for data in transit
• Hashed and salted storage of passwords
• Role-based access controls
• Multi-factor authentication for internal systems access
• Regular security assessments and penetration testing
• A formal incident response plan with 72-hour breach notification capability

No system is completely secure. If you suspect unauthorized access to your account, contact us immediately at privacy@wav.cash.

Data Breach Notification: In the event of a breach that poses a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours and notify affected users without undue delay, as required by applicable law.

11. Children's Privacy

The Platform is not directed at individuals under the age of 18. We do not knowingly collect personal information from minors.

If we become aware that we have collected personal information from a person under 18 without verified parental consent, we will take immediate steps to delete that information.

12. Third-Party Links and Services

The Platform may contain links to third-party websites or services. This Privacy Policy does not apply to those third-party services. We encourage you to review their privacy policies.

13. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors.

Material changes will be communicated by email to your registered address at least 30 days before taking effect and by prominent notice on the Platform.

Minor changes will be reflected with an updated Last Updated date at the top of this Policy.

14. Jurisdiction-Specific Disclosures

14.1 California Residents (CCPA / CPRA)

In addition to the rights described in Section 7, California residents have the rights described under the CCPA and CPRA. We do not sell or share personal information for cross-context behavioral advertising.

14.2 EU / EEA Residents (GDPR)

You have the right to lodge a complaint with the supervisory authority in the EU member state where you reside, work, or where an alleged infringement occurred. Our lead authority as a Portugal-based operator is CNPD.

14.3 UK Residents (UK GDPR)

Your rights under UK GDPR are substantively identical to those of EU residents. The relevant supervisory authority is the UK Information Commissioner's Office.

14.4 Canadian Residents (PIPEDA / Quebec Law 25)

We collect, use, and disclose personal information about Canadian residents with their knowledge and consent, in accordance with PIPEDA and applicable provincial law.

15. Contact and Complaints

For any privacy-related inquiries, rights requests, or complaints:

Sama Studios LLC
Attn: Privacy Team
privacy@wav.cash

We aim to respond to all privacy inquiries within 10 business days.