Privacy Policy

At a glance

1. Who we are and what this covers

This policy explains what MasterHold ("MasterHold," "we," "us") collects about you, why, who sees it, how long we keep it, and what you can do about it. MasterHold is the trading name of Butr inc, a company incorporated in Quebec, Canada, with its registered office at 130 Duchastel, Outremont, Quebec H2V 3G1, Canada. We operate masterhold.com, beta.masterhold.com, and the MasterHold application (together, the "Service"). This policy applies to everyone who requests a beta invitation, signs in, uses a demo or test account, connects a mailbox or a Curve account, or e-mails us.

Our role. Butr inc is responsible (the controller; in Canada, the organisation accountable under PIPEDA and Quebec's Law 25) for the processing whose purposes it decides: your account and its administration, security and abuse prevention, support, improving the Service, the shared label directory, and the records we must keep. Where you run a business and decide why the personal information inside your documents and correspondence is processed, and we process it only on your instructions to run the Service for you, we act as your processor / service provider for that processing. The role depends on the particular use — uploading a document does not make every later use a processor activity — and you remain responsible for having the right to give the document to us. If you are a business customer in the EU or UK and need written data-processing terms (GDPR Article 28) for that processing, e-mail privacy@masterhold.com.

Business-to-business data. The labels, distributors and their staff that appear in your documents and correspondence are third parties. A named person's work e-mail address is still personal information. We process it to run the Service for you and, for the shared label directory (Section 8), on our own legitimate interest.

This policy is information, not a blanket consent. Accepting the Terms does not give consent to every optional use described here. Where consent is required (connecting a mailbox or Curve, optional notifications), we ask separately, for that purpose, before the use, and you can refuse or withdraw it without losing unrelated features. Your e-mail address is needed to sign in; everything else is needed only for the features that use it — without documents we cannot calculate from them, without a connection we cannot import from that service.

2. What we collect

2.1 When you request an invitation

Your name, e-mail address, and the link to your Spotify artist profile; which versions of the Terms and this policy you accepted; a hashed form of your IP address and your browser's user-agent string (used only to stop automated abuse of the form).

2.2 Your account

• Your name, e-mail address, country, and the first name we greet you by.
• Sign-in: a one-time code sent to your e-mail address. We store a hash of the code while it is valid and a hash of your session token for up to 30 days. We never store a password.
• Your MasterHold e-mail addresses: the unique address statements can be sent to, and the address replies come back to.
• Billing and invoice details you enter: billing name and address, tax or VAT registration name and number, bank currency, and the payment details you want printed on invoices (for example bank account details). These appear on invoices sent in your name, so the labels you invoice see them.
• Your settings: which notifications reach your inbox, invoicing preferences, follow-up schedules, e-mail templates and signature, reply mode, forwarding on or off, the senders you have confirmed for mailbox searches, a logo if you upload one.
• Which versions of the Terms and this policy you accepted, and when.

2.3 Your catalogue

Releases, tracks, labels, distributors, release dates, artwork, and identifiers — including Spotify identifiers and ISRC recording codes — entered by you or imported from public catalogue data (Section 5.4), plus what MasterHold derives from them, such as which releases are missing a contract or a statement, or which tracks still have no recording code.

2.4 Your documents and what we read from them

Contracts, royalty statements, invoices, and related files you upload, forward, connect, or let us find in a connected mailbox (PDF, Excel, CSV, Word, ZIP, and images). We extract their text and use software, including AI-assisted reading (Section 5.3), to pull out the structured facts: parties, royalty rates, advances, periods, amounts, currencies, payment terms, reversion dates, shared-deal splits, and the figures the Service calculates from them. The original files are kept so you (and we, if you ask for help) can check what was read. If you would rather a document were not read by AI, enter the figures by hand instead of uploading it.

2.5 Curve connection (only if you connect it)

If you connect your Curve Royalty Systems account we hold: a Curve session token and/or your Curve sign-in e-mail and password, encrypted at rest (AES-GCM; the key is kept separately from the database); the status and progress of the connection; the payee names Curve reports under your login; and the statements collected. We decrypt the credentials only for the moment of a fetch or sign-in, never display them, and never write them to logs. Disconnecting wipes them immediately.

2.6 Gmail or Outlook connection (only if you connect one)

In short: If you connect Gmail or Outlook, the permissions you grant let us read mail and manage mailbox settings; we use them only to look for royalty statements and to set up a forward. We search your mailbox history (no date window; Outlook has the limit explained below) for messages from the statement platforms we know or from senders you have confirmed, when they carry an attachment, and for messages carrying a known statement-portal link. For Outlook only your Inbox is searched, and a sender match may be read before we can tell that it has no attachment; Gmail spam and bin folders are never searched. We keep the statements we find, not your inbox. Disconnecting deletes our stored token and asks the provider to remove the filter or rules we created; if removal fails, the app tells you what remains and how to remove it yourself. Statements already filed stay in your account.

What we ask for. When you connect a mailbox from Settings → Statement inbox (or from a release page), we send you to Google or Microsoft to sign in and grant MasterHold permission on their own consent screen. The permissions themselves are broader than our use of them; this is how MasterHold uses each one:

We do not request a scope to send mail as you, delete or move your mail, or read your contacts or calendar. If the read permission is not granted, nothing is stored and the connection is refused.

What we search for, and what we read. We search your mailbox history without a date window (subject to the Outlook limit below) for messages that match at least one of: from a statement platform we know, with an attachment (today Curve, Label Worx, Royalty Worx, SR1, Details and !K7 — the current sender domains are curveroyaltysystems.com, label-worx.com, labelworx.com, royaltyworx.com, details.eu and k7.com), from a sender you have taught us, with an attachment (an address you confirmed in the app; a whole non-public domain only when you explicitly chose that), or containing a link to a known statement portal (today sr1net.com, licensor.labelworx.com and app.details.eu). A statement word in the subject is not a search criterion. Gmail spam and bin folders are never searched; for Outlook only your Inbox is searched. We retrieve the matching messages to check and import them; a match can turn out not to be a statement (for example an unrelated attachment from a taught sender), and only a message with a supported attachment or a recognised download or portal link enters the import. For Outlook, the sender search cannot ask for attachments, so it can return messages without an attachment or portal link; we retrieve those messages to check them and reject any that have no supported attachment or recognised download or portal link. Also for Outlook, if the first search reaches 1,000 matches, the further search of older mail goes back year by year only to 2006, so older messages may be missed. We do not intentionally search unrelated mail. The search runs when you connect and is repeated by a scheduled re-sync (twice a day) while the connection is active, so new statements are picked up.

What we keep from the search. For each message we bring in: the sender, subject, date, message id and authentication headers; the statement file or portal link; and the message's provider id so we do not import it twice (we use message ids and file hashes to reduce duplicates — this is not a guarantee). The statement file is filed to your account and read as described in Sections 2.4 and 5.3, exactly as a statement you had forwarded yourself. A message that was retrieved and rejected is not filed.

What we store about the connection. The long-lived refresh token Google or Microsoft gives us, encrypted at rest (AES-GCM under a key that lives outside the database — the same protection as Curve credentials); the address of the mailbox you connected; the permissions actually granted; the id of the filter or rules we created; the ids of the messages we have already handled; the search scope and how far the search has got; and the connection's status and progress. Short-lived access tokens are used in memory and never stored. No endpoint of the Service ever returns the token, and it is never written to logs.

Google user data — Limited Use. MasterHold's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. The use of information received from Google Workspace scopes will adhere to the Google User Data Policy, including the Limited Use requirements. In plain words: we use your Gmail data only to find and file your royalty statements in MasterHold — a feature you see and control; we do not use it for advertising; we do not sell it; we share it only with the service providers needed for that feature (Cloudflare stores it, Anthropic reads the statement to extract the figures, Resend carries the copy forwarded to your own inbox); we do not use it to develop, improve or train AI or machine-learning models; and no person at MasterHold reads it unless you ask us to help with a specific message and we record that agreement, we need to for security or to investigate abuse, or the law requires it. A general support request is not permission to browse your mailbox data. These limits also apply to information derived from Gmail data. Before Gmail-derived data could be transferred as part of a merger, acquisition or sale of assets, we would obtain your explicit prior consent. These restrictions override any broader permission elsewhere in this policy or in our Terms.

Microsoft data. We apply the same limits to data received through Microsoft Graph: used only for the statement feature you turned on, never for advertising, never sold, never used to train models, read by a person only in the cases listed above, and corrected, restricted or deleted as Section 10 describes — when you disconnect, when your account is deleted, and when the law or your request requires it. Your use of the connection is also subject to Microsoft's terms for the account you connect.

Google's review of MasterHold. As of the effective date, the Google connection is configured for production but Google has not yet verified MasterHold: Google's consent screen may show an "unverified app" warning, and Google or your organisation may restrict or block the connection, or require you to reconnect. (Google's 7-day connection limit applies to apps in its "Testing" status; MasterHold left that status on 2 November 2026 — connections made before then may still need one reconnection.) The app reports a connection that stopped as "needs reconnect" — never as connected. We do not claim that Google or Microsoft has approved or endorsed the Service.

Disconnecting. You can disconnect at any time from Settings → Statement inbox. Disconnecting asks the provider to remove the forwarding filter (Gmail) or redirect rules (Outlook) that MasterHold created — never a rule you made yourself; asks Google to revoke our access (best-effort; Microsoft offers no per-app revocation, so for Outlook the token is deleted on our side only); and deletes the stored refresh token, the granted permissions and the handled-message ids. When the filter or rules were removed, the connection record is deleted too. If a filter or rule could not be removed, the app shows that it is still active and how to remove it in Gmail or Outlook; a token-free record of the connection stays until you confirm it is gone. Revoking our permission in your Google or Microsoft account on its own does not remove a forwarding filter or rule that already exists. Statements already filed to your account, and the import records that go with them, are not removed by disconnecting — they stay until you delete them or delete your account. You can also revoke our access yourself at any time at https://myaccount.google.com/permissions (Google), https://account.live.com/consent/Manage (personal Microsoft accounts) or through My Apps or your administrator (work or school Microsoft accounts); if you do, the connection stops and the app asks you to reconnect or disconnect.

2.7 E-mail

• Sent in your name: every statement request, contract request, invoice, and follow-up sent from your MasterHold address: recipients, subject, body, attachments, and delivery problems the provider reports back to us (bounces and spam complaints). We do not track whether an e-mail was opened or a link was clicked.
• Received at your address: replies and forwarded statements: sender, subject, body, attachments, download links, and the technical headers (including the sender-authentication results we use to decide whether a statement can be trusted). Statements and contracts found in them are filed to your account.
• Forwarded to you: a copy of each received message is forwarded to your own e-mail address unless you turn that off.
• The people you correspond with: names, e-mail addresses, job titles, and phone numbers of label and distributor staff, taken from your contracts, your replies, and what you type in. See Section 8 for the shared directory.
• During the beta: e-mail you send to a label may be delivered to a test inbox we control instead of the label, with the subject tagged "[BETA TEST → <the label's address>]" (see the Terms, Section 4.7). Where that happens, the message and its attachments sit in that inbox as well as in your account. Section 10.2 says how long that inbox keeps it.
• Mail to support@masterhold.com and anything you send through the in-app feedback form.

2.8 Technical and security data

Standard server logs (IP address, browser, pages and API calls, timestamps, errors), kept for the period stated in Section 10.2, for security and debugging. An audit trail of the actions the Service took for you (what was read, sent, fetched, imported, or changed) which you can see in your Activity page. A record of any time a member of our team opened your account to help you (Section 9).

2.9 Demo and test accounts

Some accounts exist only to show or test the Service: accounts our team creates, and accounts created by a "demo host" we have authorised (for example a partner showing the product). They hold synthetic or sample data; e-mail from or to a test account is blocked from leaving the Service; and they may be wiped at any time without notice. If you walk through the product in one, do not put real documents or personal information in it. Anything you type into a demo account is covered by this policy but is treated as test data; we do not promise to recover it for you. A demo host's authorisation is a separate record (the host's e-mail address) and is not removed by wiping a test account; a host can ask support@masterhold.com to remove it.

2.10 What we do not collect

No payment card details and no charges (the beta is free; the bank details you may enter are for printing on your invoices, not for paying us). No Spotify or Apple login — catalogue data is public data looked up with our own credentials. No listening data. No advertising or tracking cookies, and no third-party analytics scripts. The "Analytics" page in the app is built from your own account data only.

3. Where it comes from

Mostly from you: what you type, upload, forward, and connect. Also from your labels and distributors when they reply to e-mails sent from your account; from a Gmail or Outlook mailbox when you connect it; from Curve when you connect it; from Spotify's and Apple's public catalogue data; and from the Service's own reading of your documents.

4. Why we use it

We use your information only to:

• Run the Service for you: keep your catalogue, read your documents, work out balances and recoupment, show you what looks unpaid, draft invoices and follow-ups, send them when you tell us to, receive and file replies, find statements in a mailbox you connect, forward them to you, fill in recording codes, and watch for new releases.
• Talk to you about your account: sign-in codes, account-deletion confirmations, notices of changes to the Terms or this policy (these three cannot be switched off), and the notifications you choose in Settings → Notifications — statements received, label replies, money, connection problems, new releases, the weekly digest. New-release notifications and the weekly digest start switched off. We do not use these addresses to send you unrelated promotions.
• Keep the Service safe: detect abuse, stop spam through our e-mail addresses, limit sign-in attempts, check that forwarded statements really came from the sender they claim, investigate incidents.
• Help you when you ask: look at your account to answer a support request or fix a problem (Section 9).
• Maintain the shared directory of label and distributor business contacts described in Section 8.
• Improve the Service: understand how features are used and where documents fail to read, using your account data only as needed and never in a way that trains an AI model.
• Meet legal obligations and enforce our Terms.

We do not sell your personal data, share it for advertising, profile you for marketing, or use your documents, mailbox data, or e-mail to train AI models.

Automated processing. The Service reads documents, matches statements to releases, suggests invoices, and flags things automatically, but it does not make legally significant decisions about you on its own: every invoice and message is a draft until you press send or choose a schedule, and every figure is shown to you to check.

5. Who we share it with

We share information with the providers and connected services in Section 5.1, the people you choose to e-mail (5.2), other users who can see the limited directory fields described in Section 8, and the recipients described in Section 5.5. Each disclosure is limited to its stated purpose. We do not sell or rent your personal information. Providers that process information for us must follow our instructions and the contractual restrictions that apply to them; independent services handle the requests they receive under their own terms and privacy policies. The stricter limits for connected-mailbox data in Section 2.6 apply throughout.

5.1 Providers and connected services

The first three rows are service providers that process data for us (our sub-processors). Google and Microsoft act for you, under the permission you granted, when you connect a mailbox. Spotify, Apple, Curve, CapSolver and Google Fonts are independent services that receive only the requests described.

We will update this table before adding a provider that handles your data; if you have an account, a change to this table is a change to this policy (Section 16).

5.2 People you e-mail

When you send an invoice or a request, the label or distributor receives your name, your MasterHold address, the message, and (on invoices) the billing, tax, and payment details you entered. What they do with it is governed by their own policies. During the beta, see Section 2.7 on the test inbox.

5.3 AI reading

Document reading runs on Anthropic's Claude models through their commercial API. Your document — whether you uploaded it, forwarded it, or we found it through Curve or a connected mailbox — is sent to Anthropic to extract the figures; the structured result is stored in your account. We do not submit it for model training, and Anthropic's commercial terms do not allow it to train on API inputs or outputs. Anthropic may retain API inputs and outputs for the limited period and purposes its commercial terms allow (currently up to 30 days for standard API use, longer where required for safety or by law). We do not include Spotify-sourced catalogue content in what we send for reading. If you would rather a particular document were not read by AI, do not upload it and enter the figures by hand instead.

5.4 Public catalogue data

Catalogue import, recording codes and new-release detection use Spotify's Web API with our own application credentials (server-to-server). We request public artist, album, and track metadata, ISRC codes and artwork only. We never ask for your Spotify account, never see your listening data, and MasterHold is not affiliated with, endorsed by, or sponsored by Spotify. Spotify and its licensors keep their rights in Spotify-sourced content; it is shown to you as part of your catalogue, subject to Spotify's own terms, and neither we nor you may use it to train or otherwise feed an AI or machine-learning model. Spotify is a third-party beneficiary of this policy and our Terms and may enforce the Terms directly (this means Spotify can enforce the agreement even though it does not provide MasterHold); that status does not give Spotify access to your private MasterHold documents or account data.

5.5 Other disclosures

We may disclose data if the law requires it, to protect the rights or safety of you, us, or others, or to a successor if Butr inc is reorganised, sells the Service, or is acquired (we will tell you if that happens, this policy will continue to apply to your data until it is changed with notice, and data derived from a connected Google mailbox is transferred only with your explicit prior consent — Section 2.6).

6. Where your data lives, and international transfers

We are based in Quebec, Canada. Your data is stored and processed on Cloudflare's network, primarily in data centres in the United States, and our providers' networks may process it in other countries where Cloudflare, Resend, Anthropic, Google, or Microsoft operate. Your data can therefore be subject to those countries' laws.

• If you are in the EU, UK, or Switzerland, the Service uses recipients in Canada, the United States and the other locations described above. The legal safeguard depends on the transfer and the recipient; e-mail privacy@masterhold.com for information about the safeguards that apply to your data.
• If you are in Quebec, personal information about you is communicated outside Quebec (to Canada and the United States) under the written agreements with the providers above.
• If you are elsewhere in Canada or in the United States, your data is stored and processed as described above.

7. Legal bases (EU and UK) and consent (Canada)

If the GDPR or UK GDPR applies to you, we process your data on these bases:

• Performing our contract with you (Article 6(1)(b)): running the Service, reading your documents, sending and receiving e-mail for you, support, account deletion. (Your contract with us is not the legal basis for processing a label employee's details — see legitimate interests.)
• Our legitimate interests (Article 6(1)(f)): keeping the Service secure, preventing abuse, improving it, processing the business contact details of label and distributor staff that appear in your documents and correspondence, maintaining the shared label directory of those business contacts (Section 8), and running audited support access, in each case balanced against the rights of the people concerned.
• Your consent (Article 6(1)(a)): optional features you switch on — connecting Curve, connecting a Gmail or Outlook mailbox, forwarding your mail to your MasterHold address, and optional notifications. You can withdraw consent at any time by switching the feature off or disconnecting; what was processed before you withdrew stays lawful.
• Legal obligation (Article 6(1)(c)): where we must keep or disclose data by law.

Canada (PIPEDA and Quebec Law 25). We collect, use and disclose personal information only for the purposes described in this policy, which we identify at or before the time of collection, and with your consent — express, asked separately and for that purpose, where the information is sensitive or the feature is optional (connecting a mailbox or Curve, having a document that holds financial or contract details read by our AI provider), and implied where the use is obvious from the service you asked for (filing the statement you uploaded to your account). You can withdraw consent at any time, subject to legal or contractual restrictions and reasonable notice, by switching the feature off, disconnecting, or deleting your account.

8. The shared label directory

In short: MasterHold keeps a shared directory of label and distributor business contacts, such as a label's royalties inbox, built from the contracts and correspondence users provide and shown to all users. It is about labels, not about you, and it is not deleted because one contributing artist leaves. A named person's work contact details can still be personal information: anyone listed can ask us for access, correction or removal, or object, without having a MasterHold account.

8.1 What it is. A list of labels and distributors with the business e-mail addresses (and sometimes names and roles) that answer about statements, contracts, and payments. Entries come from the contracts users upload, from addresses that reply to e-mails sent through the Service, and from what users type when they add a contact. The directory records how often an address has been used and whether it bounced.

8.2 Why. So the next artist dealing with the same label can find the right inbox instead of guessing. It is a core part of the Service.

8.3 What it contains. Business contact details of people acting for a label or distributor: the contact fields only (e-mail address, name, role where known), never the source contract, the correspondence, royalty amounts or any other confidential content. It does not contain anything about you, your catalogue, your contracts, or your figures: the fact that you have a contract with a particular label is not in the directory. Senders found in a connected mailbox are used to search that mailbox (Section 2.6); they are not added to the directory from your mailbox.

8.4 Retention. The directory is kept when an account is deleted: your data goes (with the exceptions in Section 10); the label's inbox address stays. We remove or restrict an entry when a person asks us to (Section 8.5) or when we learn it is no longer accurate or needed.

8.5 If you work at a label or distributor. If your business contact details are in the directory and you want to see them, correct them, have them removed, or object to this use, e-mail support@masterhold.com — you do not need an account — and we will act within one month. We process these details on the basis of our legitimate interest in professional, business-to-business communication in the music industry (and, in Canada, as business contact information used for that purpose). This policy, which the e-mails sent through the Service link to, is how we tell you about this use; if you would like it explained, ask us.

9. Who at MasterHold can see your data

MasterHold is run by a very small team. Access to accounts is limited to the people who operate the Service, used only to support you, investigate a problem, keep the Service running, or meet a legal duty. When a team member opens your account in the app to help you, the Service records who did it and when, and logs every change made during that session, so there is an audit trail. We do not browse accounts out of curiosity, we do not read mail or statements found through a connected mailbox except in the cases listed in Section 2.6, and we do not share what we see.

Demo hosts we authorise (Section 2.9) can open the Test-accounts area and create, open and wipe the test accounts available to them there; they cannot open real artist accounts through that role.

10. How long we keep it, and deletion

10.1 While you have an account, we keep the records and files needed to run the Service, subject to the retention periods below.

10.2 Retention table

10.3 Deleting your account — the flow. In the app, go to Settings → Delete account. We e-mail a one-time confirmation link to the address on your account (it works once and expires after 60 minutes), to check that the person asking can read the account's e-mail. The confirmation page shows exactly what will be removed, what is kept, and the grace period before you confirm. When you confirm:

• Your account is marked for deletion and you are signed out on every device.
• For 30 days nothing is removed. Sign back in within 30 days and the deletion is cancelled automatically — there is no separate restore step — and your account is as you left it, plus anything that arrived in the meantime.
• During those 30 days the account is not frozen. In the current beta, scheduled follow-ups you had set up can still be sent, connected Curve and mailbox imports can still run, and mail sent to your MasterHold address can still arrive and be filed. If you want that to stop, disconnect Curve and any mailbox, remove forwarding rules and switch off scheduled messages before you confirm. If you ask us to stop processing or to erase your data sooner, e-mail support@masterhold.com and we will act on it as the law requires.
• After 30 days the account becomes eligible for the daily purge, which removes from our live systems: your profile and billing details, catalogue, contracts, statements, invoice files, extracted figures, e-mail threads and attachments, contacts you added, Curve connection and credentials, Gmail/Outlook connections and tokens, settings, sessions, support-access records, your beta-request record, and every file stored for you. Invoice and audit records are kept 7 years with personal details removed, as in the table above. The shared label directory (Section 8) stays.

If you cannot sign in, e-mail support@masterhold.com from the address on your account. After we confirm your request by reply, our team uses a separate administrator tool that differs from the self-service flow: it deletes the account's live application records immediately, including its invoices and activity trail; there is no 30-day grace period, no sign-in restoration and no 7-year retention of those records. The shared label directory stays, and the other exceptions in this Section (backups, incident records, copies the purge does not reach) still apply. Ask for an export before confirming this request.

What deletion does not reach. Deletion removes your account data from our live systems, subject to the retained records, the shared directory and the backups listed above. Copies already delivered to other people (a label you invoiced, your own inbox), copies our providers hold under their own retention periods (for example Anthropic — Section 5.3 — or our e-mail provider's delivery logs), and the beta test inbox (Section 2.7) are not reached by the account purge; they are governed by the periods in the table above and by the providers' terms.

10.4 Backups. Our database keeps point-in-time recovery copies for up to 30 days; deleted data can persist in those copies until they age out, and is used only to recover from a failure, never to restore an account you asked us to delete. Files are deleted from storage directly.

10.5 If we close the Service, we will give you reasonable notice — at least the 60 days' written notice Quebec consumer law requires where it applies — and a chance to export your data before it is deleted (see the Terms, Section 15.5).

11. Security

• Connections between your browser and the Service use HTTPS (TLS). E-mail in transit is also protected by the sending and receiving mail systems, which we do not control.
• Curve credentials and mailbox refresh tokens are encrypted at rest with AES-GCM under keys that are held separately from the database and never stored alongside the data they protect; they are decrypted only for the moment they are used.
• Sign-in uses one-time codes delivered to your e-mail, so there is no password to steal. Your browser holds a secure, HTTP-only session cookie; we store only a hash of the session token on our server.
• Mailbox connections use the standard OAuth flow with PKCE and a short-lived, single-use state bound to your session; we only accept the connection on the exact addresses of our own site.
• Each account has its own e-mail addresses and its own storage; replies are matched to your account by a code we issue, not by who the sender claims to be, and statements that arrive by e-mail or through a connected mailbox are checked against the sender's authentication results before they are trusted.
• Our outgoing e-mail is DKIM-signed and published with SPF and DMARC records, so receiving mail servers can check that mail in your name really came from us.
• Administrator access to accounts through the app is recorded, and changes made during such a session are logged (Section 9).
• Secrets and API keys are stored in our hosting provider's secret store, not in code.

No system is perfectly secure. If you believe your account or data has been compromised, e-mail support@masterhold.com immediately.

If we have a security incident. We investigate, take steps to reduce the harm, and keep the records the law requires. Where we act as your processor, we tell you without undue delay after becoming aware of a personal-data breach. Under the EU or UK GDPR we notify the competent regulator without undue delay and, where feasible, within 72 hours unless the breach is unlikely to risk people's rights and freedoms, and we tell affected people without undue delay where it is likely to create a high risk. Where PIPEDA applies, we notify the Privacy Commissioner of Canada and affected people as soon as feasible if there is a real risk of significant harm. Under Quebec law, we promptly notify the Commission d'accès à l'information and affected people where there is a risk of serious injury.

12. Your rights

12.1 Everyone

You may send any privacy request or complaint to privacy@masterhold.com; the support address in the table also accepts them.

12.2 EU, UK, and Swiss residents. You also have the rights to restrict or object to processing, to data portability, to withdraw consent, not to be subject to a solely automated decision with legal effect (we make none), and to lodge a complaint with your data protection authority — in the UK the Information Commissioner's Office (ico.org.uk), in the EU the authority of the country you live in. We would appreciate the chance to resolve it with you first.

12.3 Canada (PIPEDA and Quebec). You have the right to be informed of the personal information we hold about you, to access it, to have it corrected, to withdraw consent, and to complain to our Privacy Officer (Section 17), to the Office of the Privacy Commissioner of Canada (priv.gc.ca) and, in Quebec, to the Commission d'accès à l'information (cai.gouv.qc.ca). Quebec residents also have the right to ask that personal information be de-indexed or cease to be disseminated in the circumstances Law 25 provides, and to receive computerised personal information they provided in a structured, commonly used technological format.

12.4 California residents. We offer everyone the request options in 12.1. If the California Consumer Privacy Act applies to our processing, you also have the right to know what personal information we collect, use, disclose and share (this policy describes it; the categories are identifiers, account and billing details, commercial information, internet activity in our logs, professional information, and the contents of documents and messages you give us), to delete it, to correct it, to limit the use of sensitive personal information, and not to be discriminated against for exercising those rights. Depending on what you provide or connect, sensitive personal information can include the contents of e-mail, account-access credentials or tokens, and financial or tax details; we use those only for the mailbox, document, connection and invoicing features you asked for and for necessary security, subject to Section 10, and we do not use them to infer characteristics about you. We do not sell or share personal information for cross-context behavioural advertising, so there is nothing to opt out of. You may use an authorised agent; we will verify the agent's authority with you.

12.5 How we verify, and when we answer. For account holders, we act on requests that come from the e-mail address on your account, or that you confirm from it. You can also write to support@masterhold.com if you have no account (for example you work at a label) or have lost access to your address; we then use reasonable checks suited to the request, without asking for more than we need. We respond within the deadline that applies to your request — normally one calendar month for EU/UK requests and 30 days under Canadian law — and if a request is complex we will tell you why and when, within what the law allows. We explain any refusal, extension or retained information, and your right to complain. Requests are normally free; we charge a fee or refuse a request only where the law that applies permits it, and we explain the reason and any review or complaint route.

13. E-mail forwarding and mailbox connections: what you are agreeing to

13.1 Your MasterHold address. Your account has a unique masterhold.com address. If you give it to a label as the place to send statements, or create a rule in your own mailbox that forwards messages to it, you are asking MasterHold to receive and process everything sent there: the sender's name and address, the message, and any attachments or download links, which we read, file against your releases, and forward on to you. Forwarded mail inevitably includes other people's details (the label staff who wrote it), which we hold as part of your correspondence. Only forward what you are entitled to share. To stop mail arriving, remove the rule in your own mailbox or stop giving out the address; turning forwarding off in Settings stops the copies sent on to your own inbox, not what arrives at the MasterHold address. What has already been filed stays in your account until you delete it.

13.2 A connected Gmail or Outlook mailbox. If you connect a mailbox you are asking MasterHold to search it for possible statement e-mails as described in Section 2.6, to bring matching messages into your account, and to create a Gmail forwarding filter or up to three Outlook redirect rules in it so future matching messages reach your MasterHold address. We do not intentionally search unrelated mail. The same responsibility applies: connect only a mailbox you are entitled to use, and only where you may share its statement mail with us and our providers. To stop messages arriving from a connected mailbox, disconnect it and remove any rule the app tells you is left behind.

14. Cookies

The Service uses one cookie: the session cookie that keeps you signed in (secure, HTTP-only, up to 30 days). A team member or demo host helping you may have a second, short-lived cookie that returns them to their own account. The mailbox-connection flow uses a short-lived state value, not a cookie. There are no advertising, analytics, or tracking cookies, and we do not use third-party analytics.

15. Children

The Service is for adult account holders. We do not knowingly open an account for, or collect data from, anyone under 18, and if we learn that we have, we close the account and delete its data under Section 10. A document an adult legitimately holds that mentions a minor is that adult's content and is handled as such.

16. Changes to this policy

Every version carries a version number and effective date, and the current version is always at masterhold.com/legal/privacy. When we change it you will be asked to accept the new version at your next sign-in. A change never takes away rights the law gives you, and never authorises a new consent-based use of your data — in particular a new use of connected-mailbox data — before you have given that consent. If a change materially reduces your rights, adds a provider that handles your data, or changes how a connected mailbox or Curve account is used, we will e-mail you at least 30 days before it takes effect. You can export your data or exercise your rights without accepting a new version; if you do not accept, you can stop using the Service and delete your account.

17. Contact, Privacy Officer, and complaints

Questions, requests, or complaints about your data:

E-mail: privacy@masterhold.com for anything about your personal information · support@masterhold.com for everything else Person in charge of the protection of personal information (Quebec Law 25) / privacy contact: the President of Butr inc, reachable at privacy@masterhold.com Operator: Butr inc, trading as MasterHold Address: 130 Duchastel, Outremont, Quebec H2V 3G1, Canada Website: https://masterhold.com

If you are not satisfied with our answer, you can complain to the data protection authority in your country (Sections 12.2 and 12.3).