Privacy Policy

This Privacy Policy explains what personal data theDirectory collects, how we use it, and the rights you have. It applies to the website operated by VOID MUSIC GROUP. See also our Terms of Service.

1. Who we are

theDirectory is a reference directory and research tool for the music distribution, publishing, and label industries. The service is operated by VOID MUSIC GROUP (VOID.AUDIO), a French société par actions simplifiée (SAS) registered under SIREN 992 576 322, with its registered office at 25 Rue de Ponthieu, 75008 Paris, France ("VOID", "we", "us").

VOID is the data controller responsible for the personal data processed through theDirectory. For any privacy matter you can reach us at privacy@thedirectory.fm.

2. Data we collect

We collect the following categories of data, depending on how you use theDirectory:

• Account data — when you create an account, your email address, a password (stored only as a salted hash by our authentication provider), and any display name or profile details you add. If you sign in with Google, we receive your basic Google profile (name and email).
• Reviews and contributions — the content of any review you write, the star rating and per-dimension sub-scores, and an optional display name. If you submit a review without an account, we collect the email address you use to confirm it. Any supporting evidence you upload with a review is stored privately and used only to verify and moderate that review.
• Anti-abuse data — to limit spam and fake reviews we store a salted, irreversible cryptographic hash of your IP address. We do not store your raw IP address.
• Listing and claim data — if you submit or claim a company listing, the business information you provide and the contact details or documentation used to verify the claim.
• Billing data — for paid Pro subscriptions: your name, billing email, country, any VAT or tax identifiers, and your subscription status and identifiers. Card payments are handled directly by our payment processor, Stripe; we never receive or store your full card number.
• Usage and technical data — the pages and listings you view, the search queries you enter, approximate device and browser information, and server log data. We also keep an aggregate view count per company listing.
• Communications — the content of messages you send us by email or through the site.

3. How we use your data and our legal bases

We process personal data in line with the EU General Data Protection Regulation (GDPR) and French data-protection law, on the following bases:

• To provide and operate theDirectory and your account, and to deliver the features you request — performance of a contract and our legitimate interest in running the service.
• To publish, verify, and moderate reviews and company listings — our legitimate interest in maintaining a trustworthy directory, and performance of a contract where you are a registered contributor.
• To process Pro subscriptions, take payment, and issue invoices — performance of a contract and compliance with our accounting and tax obligations.
• To interpret your queries through AI-assisted search — our legitimate interest in providing a useful search experience.
• To detect, prevent, and investigate fraud, spam, abuse, and security incidents — our legitimate interest in protecting the service and its users.
• To communicate with you about the service, including verification, transactional, and support messages — performance of a contract and our legitimate interest.
• To measure and improve the service through analytics — your consent, or our legitimate interest where permitted.
• To comply with our legal obligations and to establish, exercise, or defend legal claims — compliance with a legal obligation and our legitimate interest.

4. AI-assisted search

theDirectory offers an AI-assisted search that turns your query into structured filters. To do this, the text you type into the search bar is sent to our AI provider, Anthropic, which processes it and returns a structured interpretation. We do not attach your account identity to the query, and our provider does not use data submitted through its API to train its models. A standard text search is available if you prefer not to use AI search.

5. Cookies and similar technologies

We use strictly necessary cookies to keep you signed in and to operate core features such as authentication and security; these do not require consent. Where we use any non-essential or analytics technologies, we do so on the basis of your consent, which you can withdraw at any time. You can also manage cookies through your browser settings.

6. Service providers and sharing

We share personal data only with the service providers (processors) that help us run theDirectory, each on a need-to-know basis and under appropriate contractual safeguards:

• Supabase — database hosting, authentication, and file storage.
• Vercel — application hosting and content delivery.
• Stripe — payment processing and subscription billing.
• Resend — sending transactional and verification emails.
• Anthropic — processing AI-assisted search queries.
• Google — optional Google sign-in, if you choose to use it.

We may also disclose data to professional advisers or to competent authorities where required by law. We do not sell, rent, or trade your personal data to third parties for marketing purposes.

7. International transfers

Some of our providers are located outside the European Economic Area, including in the United States. Where personal data is transferred outside the EEA, we rely on appropriate safeguards under Chapter V of the GDPR, such as the European Commission's Standard Contractual Clauses or an adequacy decision.

8. How long we keep your data

• Account data — for as long as your account is active, and for a reasonable period afterwards.
• Reviews and public contributions — for as long as they remain relevant to the directory. When you delete a review or your account, we remove or anonymize the associated personal data, although aggregate ratings may be retained.
• Billing and accounting records — for 10 years, as required by French commercial law.
• Review verification links — for 24 hours, after which they expire.
• Anti-abuse and technical data — for a maximum of 13 months.
• Correspondence — for up to 3 years from our last contact with you.

9. Your rights

Subject to applicable law, you have the right to access your personal data and to request its rectification or erasure; to restrict or object to its processing; to data portability; and to withdraw your consent at any time where processing is based on consent. Under French law you may also give directives concerning the fate of your data after your death.

To exercise these rights, email us at privacy@thedirectory.fm. We may need to verify your identity before responding. You also have the right to lodge a complaint with the French data-protection authority, the Commission Nationale de l'Informatique et des Libertés (CNIL — www.cnil.fr).

10. Security

We use technical and organizational measures to protect personal data, including encryption in transit (TLS), salted hashing of passwords and reviewer IP addresses, access controls, and moderation of uploaded files. No method of transmission or storage is completely secure, but we work to protect your information and to address any incident promptly.

11. Children

theDirectory is intended for professionals and the general adult public and is not directed to children under 16. We do not knowingly collect personal data from children under 16. If you believe a child has provided us with personal data, please contact us and we will delete it.

12. Third-party websites

theDirectory links out to the websites of the companies it lists and to other third-party services. We do not control those sites and are not responsible for their content or privacy practices; their own policies govern your use of them.

13. Changes to this policy

We may update this Privacy Policy from time to time. The version published on this page, with its "last updated" date, is the one in force. Material changes will be indicated by updating that date, and your continued use of theDirectory after an update constitutes acceptance of the revised policy.

Contact

Questions about this policy? Email privacy@thedirectory.fm, or write to VOID MUSIC GROUP (VOID.AUDIO), 25 Rue de Ponthieu, 75008 Paris, France.