Privacy Policy

Effective October 23, 2026

1. What we collect

Information you give us

Account: your name, work email, company, role, and password. Passwords are stored only as a salted hash (bcrypt), so we never see them. If you sign in with Google, we receive your name, email address, and Google account ID. We don't receive your Google password or anything else from your Google account.
Demo bookings: your name, company, work email, the time you chose, and your time zone.
Catalog material: files and notes you upload or send us, such as catalogs, work and writer lists, royalty statements, and agreements.
Review choices: the "File? Yes / No" choices you make on review links.
Messages: what you send us by email, through the site, or on calls.
MLC access: to submit approved filings, you add us as a team member on your MLC account. We sign in with our own login. We never ask for, receive, or store your MLC password, and you can remove us from your team at any time.

Payment information

Card payments are handled by Square. Your full card number goes directly to Square and never reaches our servers. We keep Square's customer and payment reference numbers, your plan, and your payment dates.

Information collected automatically

Logs: IP address, browser type, the pages requested, and when. We keep these for security and to fix problems.
Review links and bookings: each review choice and each demo booking is recorded with its time, IP address, and browser, so there is a reliable record.
Cookies: see Section 6.

Information about people in the catalogs we review

Our work involves names and identifiers of songwriters, artists, publishers, and other rights holders. That includes legal and professional names, IPI numbers, ownership shares, registrations, and credits. We get these from public sources such as the MLC's public data, performing rights organizations' public repertoire listings, streaming services' public metadata, and copyright records, and from our clients. We use this information only to determine who wrote, owns, and is owed money for each work, and to correct the records. If you are one of these people, Section 8 explains your choices.

2. How we use it

To provide the Service: audit catalogs, prepare reports, and prepare and submit the filings our clients approve.
To run accounts, sign-in, billing, and demo scheduling, including reminder emails.
To communicate with you about your account, findings, filings, and changes to the Service.
To keep the Service secure, prevent fraud and abuse, and keep records of approvals.
To improve our matching methods, using statistics that don't identify you, your catalog, or any writer.
To meet legal, tax, and accounting obligations, and to enforce our Terms.

We send marketing email only to people who asked for it or are existing customers, and every marketing email has an unsubscribe link.

Automated processing: we use software, which may include AI models, to compare records across sources. A person reviews filings before they are submitted, and nothing is filed without the client's approval.

We do not use customer information to train AI models, and we don't allow our service providers to use it for that.

We don't sell personal information, and we don't share it for cross-context behavioral advertising. We share it only:

With service providers that run parts of the Service for us, under contracts that limit them to that work:
- DigitalOcean (hosting)
- Amazon Web Services (storage and email delivery)
- Google (email, calendar, and Google sign-in)
- Square (payments)
- Calendly (backup demo booking)
With the MLC and similar bodies, when we submit a filing the client has approved. That is the purpose of the filing.
Within a client's team, for example a teammate on the same account, or people the client gives a review link to.
If the law requires it, or to protect rights, safety, or the security of the Service.
In a business transfer, such as a merger or sale of our business. The new owner must keep honoring this policy, and we'll tell you before your information falls under a different policy.

4. How long we keep it

Account information: while your account is open, plus 24 months after it closes.
Catalog material and findings: while your account is open. After it closes, we delete them within 90 days of a request, or 12 months after closure if you make no request.
Approval and filing records (review choices and submitted filings): 7 years, because they document what was authorized and filed.
Billing records: 7 years, for tax and accounting.
Demo bookings: 12 months after the meeting.
Server logs: 90 days.

Deleted data may stay in backups for a limited time until those backups expire.

5. Security

We use HTTPS throughout, hash passwords, store data with providers that encrypt it at rest, restrict access to the people who need it, and protect forms against cross-site request forgery. No system is perfectly secure. If we learn of a breach that affects your personal information, we will notify you as the law requires.

6. Cookies

We use only the cookies the site needs to work:

Cookie	What it does	How long
`tex_session`	Keeps you signed in	30 days
`tex_csrf`	Protects forms from forgery by other sites	1 year
`tex_g`	Holds a Google sign-in in progress	10 minutes

We set no analytics, advertising, or social-media tracking cookies. If our backup Calendly booking widget is shown, Calendly may set its own cookies under its own policy. Because we don't track you across sites, there is nothing to opt out of. We treat Global Privacy Control signals as opt-out requests anyway.

7. Your choices and rights

Wherever you live, you can ask us to:

tell you what personal information we hold about you and give you a copy;
correct it;
delete it;
stop using it for marketing.

Email hello@pacehandy.com from the address on your account, or tell us enough for us to verify who you are. We'll respond within 45 days. We won't treat you differently for making a request. Some information must be kept for legal reasons, such as billing and filing records, and we'll tell you when that applies.

California and other US states with privacy laws: you have the rights listed above, plus the right to know the categories of information we collect and share (Sections 1 and 3), and to have an authorized agent make a request for you. We don't sell or share personal information as those laws define those terms, and we don't use sensitive personal information to infer characteristics about you.

UK and EU: where these laws apply, our legal bases are: performing our contract with you; our legitimate interests, and the rights holders' interest, in accurate royalty records; legal obligations; and consent for marketing. You can also object to processing, restrict it, ask for your data in a portable format, and complain to your data protection authority. We store data in the United States.

8. If you're a writer or rights holder in a catalog we reviewed

We process your professional information to make sure works are credited and paid to the right people. That information is mostly public registration data, and the work often benefits you directly. You can ask what we hold about you, ask us to correct it, or object to our processing by emailing hello@pacehandy.com. If our client is your publisher or administrator, we may also refer you to them.

9. Children

The Service is for businesses. It isn't directed to anyone under 18, and we don't knowingly collect personal information from children. If you believe a child has given us information, contact us and we'll delete it.

10. Changes

If we change this policy, we'll update the effective date. For material changes, we'll also email account holders before the change takes effect.

11. Contact

Pace & Handy Co. LLC
400 Renaissance Center
Detroit, MI 48243
hello@pacehandy.com