Privacy Policy

Effective date: October 12, 2026 | Version: 2026-10-12 | Last updated: October 12, 2026

This Privacy Policy explains how Walter de Minicis ("we", "us", "our") collects, uses, stores, shares, and protects personal data across Telia's public website, members hub, and admin operations (together, the "Service"). It is written to reflect the systems we actually operate today, including public commerce, subscriptions, account tools, the fan feed, playlists, music playback, uploads, and gated media access.

1. Controller and scope

The controller for the processing described in this policy is:

Walter de Minicis
Via Mura degli Angeli 25, 16127 Genova, Italy
Email: privacy@teliamusic.com

This policy applies to:

• Public: teliamusic.com for marketing pages, releases, help, legal pages, one-off commerce, profile, addresses, orders, and downloads.
• Hub: app.teliamusic.com for account access, pricing, subscriptions, billing portal, feed, playlists, and music features.
• Admin: admin.teliamusic.com where authorised staff review and operate customer, commerce, entitlement, moderation, and support workflows.

We have not appointed a separate DPO. Privacy requests can be sent to the contact above.

2. Personal data we collect

Account and identity data

When you register, sign in, maintain an account, or interact with support, we may collect your email address, username, display name, hashed password, role claims, user/account identifiers, and the profile details you choose to provide such as name, birthday, phone number, and avatar.

Account sign-in and Google

We use the Better Auth library in our application for email/password, Google and passkey sign-in. Account credentials, provider links and revocable sessions are stored in our Cloudflare D1 database. If you choose Google, we receive your Google account identifier, email and verification status, and your name and profile image when available, to sign you in to your Telia account. We do not receive your Google password.

Your public name and profile image may appear alongside your community activity according to your profile settings. Necessary account information may also be processed by our service providers for the purposes described in sections 4 and 6, including account emails. Signing in with Google does not subscribe you to our newsletter or grant marketing consent.

Consent and preference data

We store cookie choices in the telia_consent cookie and record account-level consent or withdrawal events in our database, including purpose, status, timestamp, source, and limited compliance evidence such as a hashed IP when appropriate.

Commerce, subscription, and entitlement data

If you purchase products, subscribe, manage billing, or claim guest orders, we process billing and shipping details, order history, download entitlements, Stripe customer and subscription references, and the entitlement records used to decide access to paid content.

Community, playlist, and media data

When you use the feed, comments, polls, playlists, reactions, or upload media, we process the content you submit, moderation and visibility settings, playlist artwork, avatars, feed comments and likes, playback/listen events, and the metadata needed to deliver locked or unlocked media. For locked content we may generate separate preview derivatives, such as blurred preview images or poster frames, and store them independently from the full asset.

Technical, session, and security data

We process IP-derived request metadata, browser/device information, authentication session records in our application database and necessary authentication cookies, media access decisions, signed URL issuance, abuse-prevention telemetry, and internal observability data such as request correlation IDs.

End-to-end encrypted direct messages

Direct-message text is encrypted and decrypted in participating browsers. Private keys remain in browser storage. We process and store ciphertext envelopes and operational metadata needed to deliver the feature, including participant and device identifiers, public device keys, timestamps, message counts, ciphertext sizes, and read/delivery state. The stored service data does not include direct-message plaintext or browser-held private keys.

Communications and marketing data

Our OrangeCRM application manages contact details, email preferences, newsletter confirmation requests and account, order and support emails. We send it the contact, form and message information needed for these actions, and selected profile details such as name, language, time zone, phone, country and birthday when provided. Resend remains the email delivery infrastructure used by the CRM.

Newsletter confirmation is separate from account email verification and cookie choices. Marketing eligibility is checked against the CRM's subscription preferences, confirmation and suppression status. Creating an account does not grant marketing consent.

3. Sources of data

We collect data:

• directly from you when you create an account, place an order, subscribe, upload content, edit your profile, or contact us;
• automatically from your browser or device when you use the Service;
• from Google when you choose Google sign-in, and from authentication performed by our application;
• from Stripe and related billing events when you purchase or manage a subscription;
• from Cloudflare and our infrastructure providers for delivery, security, and logging;
• from Google services when you use address autocomplete or consent to embedded external media;
• from internal admin and moderation workflows when staff review support, commerce, entitlement, or abuse issues.

4. Why we use your data and our legal bases

5. Cookies, analytics, marketing, and external media

We use a consent model with separate categories for necessary, preferences, statistics, marketing, and external media. Your browser-side choice is stored in telia_consent, and a new consent prompt is shown when the policy version changes materially.

• Necessary: includes the authentication and security cookies used by our Better Auth application.
• Statistics: governs tag-managed analytics such as Microsoft Clarity.
• Marketing: governs marketing tooling such as the Meta script path when configured.
• External media: governs third-party embeds such as YouTube and similar services.
• Functional third-party requests: Google Maps Places is used on address forms to improve address accuracy; this is a service request path, not a general advertising feature.

See our Cookie Policy for the current inventory and management options.

6. How we share personal data

We do not sell your personal data. We share it only with service providers, business partners, and authorised internal personnel when necessary to operate the Service, comply with law, or protect our rights and users.

We may also disclose data if required to comply with law, respond to valid legal process, defend our rights, investigate abuse, or protect the safety of users and the Service.

7. International transfers

Some of our service providers operate outside the EEA, the UK, or Switzerland. Where personal data is transferred internationally, we rely on the provider's applicable transfer mechanism, which may include adequacy decisions such as the EU-US Data Privacy Framework where available, or contractual safeguards such as the European Commission's Standard Contractual Clauses and the UK addendum/IDTA, together with supplementary measures where needed.

8. Retention

We keep data for as long as we need it to provide the Service, comply with law, resolve disputes, and protect the platform. The most important practical rules in our current system are:

• Account and profile data: kept while the account remains active. If you delete your account, we delete or anonymise account-linked data where our workflow supports it, including credentials, avatars, and certain community records.
• Web sessions and claims: our application stores revocable sessions in D1, with a shorter session lifetime for privileged accounts. Signing out or revoking a session prevents further access with that session.
• Cookie consent: telia_consent is stored for 365 days unless replaced earlier by a new decision or policy-version bump.
• Orders, invoices, subscription and fulfillment records: retained for legal, tax, accounting, fraud-prevention, and customer-support reasons, typically up to 10 years where required.
• Consent audit and unsubscribe records: retained for as long as necessary to prove compliance, honor opt-outs, and defend legal claims.
• Email delivery and engagement records, and contact history: full-data deletion requests are tracked separately for Telia's local cleanup and the CRM's completion. Acceptance of a CRM request is not treated as completed deletion; applicable legal retention requirements still apply.
• Support, abuse, and media-access logs: kept as needed for support, moderation, security, and incident investigation, then reviewed, rotated, deleted, or anonymised in the ordinary course of operations.
• Uploaded media and preview derivatives: kept while the related content, playlist, avatar, or entitlement-controlled asset remains in use, or until deleted/replaced.
• Encrypted direct messages: if one participant deletes their account, we remove that person's recipient envelopes, read/delivery state, active device access, blocks, and identifying profile data. The other participant retains their ciphertext history; public sender keys still required to decrypt it are revoked and stripped of device labels and timestamps. The shared conversation and remaining ciphertext are deleted after every participant has independently deleted their account.

Account and Google profile data follow the account retention rules above. Account deletion removes the native credentials and sessions. Removing account access and requesting deletion of all eligible personal data are separate options; legal retention requirements still apply.

9. Your rights and choices

Depending on where you live, you may have rights to access, correct, delete, export, restrict, or object to certain processing, and to withdraw consent where consent is the basis for processing.

We already provide the following self-service flows in the product:

• account preference updates, including marketing consent management;
• one-click unsubscribe links in email communications;
• account data export;
• account deletion;
• guest-order claim and account-area access to orders, addresses, and downloads.

You can review or remove the Google connection in your Google Account connections. Removing this connection does not delete your Telia account or data already received. To request their deletion, use the account deletion options or contact us at the address below.

If you are in the EEA, UK, or Switzerland, you can also lodge a complaint with your local supervisory authority. If you are in California or another US state with comparable privacy rights, you may request access, correction, or deletion subject to applicable exceptions. We do not sell personal data, but some consent-based advertising or analytics disclosures may be treated as "sharing" under certain US state laws.

To exercise rights or ask a question, email privacy@teliamusic.com.

10. Security and minors

We use layered technical and organisational measures designed to protect personal data, including authenticated access controls, short-lived session/claims tokens, consent logging, and server-side checks before private media is released. No system is perfectly secure, and you are responsible for safeguarding your credentials and devices.

The Service is not directed to children under 13. If you believe a child has provided personal data without the required permission, contact us so we can review and act.

11. Changes to this policy

We may update this Privacy Policy from time to time to reflect legal, technical, or operational changes. When we make a material change, we will update the version/date shown above and, where required, trigger a new consent prompt so you can review the change.

12. Contact

For privacy requests or questions, contact:

Walter de Minicis
Via Mura degli Angeli 25, 16127 Genova, Italy
Email: privacy@teliamusic.com

You can also review and update your settings anytime at Manage Preferences.

Walter de Minicis - Privacy Policy - Version 2026-10-12 - October 12, 2026