Service providers and other third parties
Last updated . Effective . Version 2026-10-11.
This page lists the companies that process personal data about our customers and their staff when eleMusic Inc. ("eleMusic", "we" or "us") runs the eleMusic service, what each one receives, and where. It supplements our Privacy Policy. It is information, not a contract.
Key points
- We use service providers to host the service, deliver audio, take payments, send account email and catch errors. Their terms with us limit their use of the data to providing their services to us and, where those terms allow, keeping their services secure, preventing fraud and meeting their legal obligations. Stripe also handles some payment data as an independent company under its own privacy policy, for example for fraud prevention.
- Some of the accounts we use are currently registered to related companies, which hold them for us (Section 3).
- We choose providers whose published privacy and security commitments, in our judgment, give personal data the same or equal protection as our Privacy Policy describes. The related companies in Section 3 hold accounts for us at our direction, and we have not authorized them to use eleMusic data for anything else.
- Some companies, such as Google when you choose Google sign-in or casting, and Apple or Google Play when you install our app, handle data under their own privacy policies.
- We do not sell or share personal information, as those terms are defined in US state privacy laws, and have not done so in the past 12 months. We do not use it for targeted advertising. We do not send customer personal data to the AI models we use to make music.
- We list a new or replacement provider here before it receives personal information. Adding or replacing a provider for a purpose our Privacy Policy already describes is not a material change; for a material change, we give the notice described in Section 18 of our Privacy Policy.
This summary is for convenience only. If it differs from the text below, the text below controls.
1. How we use providers
A "service provider" (sometimes called a subprocessor or processor) is a company that processes personal data on our behalf and under our instructions. For the personal data described on this page, eleMusic decides how and why it is processed and acts as a "business" or "controller". eleMusic is not a processor or service provider to any practice, and this page does not create a data processing agreement.
We choose providers that publish security and privacy commitments, we give them only the data their service needs, and we use their services under terms that limit how they may use that data. Those terms may also let a provider use some data for its own purposes, such as keeping its services secure, preventing fraud or meeting its legal obligations; Stripe's broader independent uses are noted in its row. Their own privacy policies are linked below.
eleMusic is not designed to receive patient information or other protected health information, and none of the providers below is engaged to process it. Please do not enter patient information in practice names, room labels, track reports or messages to us. See our Terms of Service.
"Location" shows the country where a provider stores or processes the data when our own configuration or the provider's public documentation tells us. Where it does not, the entry reads "See provider", and the provider's linked policy describes where it operates.
2. Service providers
| Provider | Purpose | Personal data involved | Location | Privacy policy |
|---|---|---|---|---|
| Render | Hosts our account and sign-in service, its database, and the elemusic.fm websites, and delivers them through its edge network, operated by Cloudflare, Inc., which handles the IP address, request headers and TLS connection of every visit and keeps short-lived cached copies of public pages. The account is currently held for us by a related company (Section 3). | Account data (email, name, profile photo link, password hash, sign-in identifiers, last sign-in time); location membership and roles; practice and location data (practice name, contact email, billing address from checkout, plan, status, trial and billing period dates, Stripe customer and subscription identifiers, billing event history, access code, certificate id and certificate active periods); records of each acceptance of our Terms (document version, time, IP address, and device and browser type); room device records (room label, device and browser type, IP address, last check-in time); sign-in session records (device and browser type, IP address); and server logs. | United States (Oregon) for the account service and database. Websites and the edge network: global; see provider. | render.com/privacy; cloudflare.com/privacypolicy |
| Modal | Runs our music catalog and playback API and the jobs that build the catalog. | Practice identifier from the playback token, a random device identifier, track reports in transit (including the room label), IP address and device or browser type of requests, and server logs. | See provider | modal.com/legal/privacy-policy |
| Amazon Web Services (Amazon S3) | Stores the music catalog and delivers audio to your devices; stores track reports. The account is currently held for us by a related company (Section 3). | IP address and device or browser type of each device that downloads audio; track reports (practice identifier, track, the room label in the report text, a random device identifier, time). | United States (us-west-2) | aws.amazon.com/privacy |
| Stripe | Hosted checkout, subscriptions, invoices, the billing portal, payment processing and fraud prevention. Stripe also processes some of this data as an independent controller, under its own privacy policy, for fraud and loss prevention and to meet its legal obligations. | Contact email, name, billing address, phone number if you add one in the billing portal, payment method details, IP address and device data Stripe collects on its checkout pages, and our practice and location identifiers. | See provider | stripe.com/privacy |
| Resend | Sends account email: password resets, the welcome email for a new location, and service alerts. | Recipient email address and the message contents, which can include a practice name, an access code and a certificate link. | See provider | resend.com/legal/privacy-policy |
| Sentry | Error and performance monitoring for the web player, the mobile apps and our servers. The account is currently held for us by a related company (Section 3). | Error reports, performance timings and app session counts, with device, browser and operating system type. Our apps and servers are configured to remove email addresses, sign-in and playback tokens, access codes, request bodies and query strings from reports before they are sent, and we do not attach user accounts to reports. Automated filtering is not perfect, and a report could occasionally include such data; if we find any, we take reasonable steps to delete it. Sentry receives the network address of the device or server that sends a report. | United States | sentry.io/privacy |
| Google Workspace | Our email at elemusic.fm addresses, including support, licensing and privacy requests. | Whatever you send us by email: your name, email address and message contents. | See provider | policies.google.com/privacy |
| Expo (EAS Update) | Delivers software updates to the eleMusic mobile apps. The account is currently held for us by a related company (Section 3). | Device operating system, our app's project identifier, a random installation token, and request data such as IP address. | See provider | expo.dev/privacy |
3. Accounts held by related companies
While we move them into eleMusic Inc.'s own name, some of the accounts we use to run eleMusic are registered to companies related to us, which hold them on our behalf:
- Third Space LLC holds the Render workspace that hosts our account service, its database and our websites, the Amazon Web Services account that contains our audio storage, and our Sentry organization.
- Graverholt Unlimited, LLC holds our Apple App Store and Google Play developer accounts, under which it publishes the eleMusic apps for us, and our Expo account.
Each of these companies holds these accounts for us at our direction. We have not authorized any of them to access eleMusic data except to hold and administer these accounts for us, or to use it for any other purpose. Other accounts we use, such as our Google Workspace email and our Google Cloud project, may also be registered to or administered through one of these companies while we move them, on the same basis. We keep eleMusic data in its own storage bucket, database and projects within those accounts, separate from the companies' other data. We will update this page when each account moves.
4. Independent third parties
The companies below are not our service providers for the data listed. You deal with them directly, or they decide for themselves how to use the data, under their own terms and privacy policies. We do not control their practices.
| Company | When | Personal data involved | Location | Privacy policy |
|---|---|---|---|---|
| Google (Sign in with Google) | Only if you choose to sign in with Google. | Google handles the sign-in. With your permission, Google gives us your Google account identifier, your verified email address, your name and your profile photo link. We use them to create your eleMusic account and sign you in, to secure it, to link your sign-in to an existing eleMusic account with the same verified email address, and to contact you about your account, locations and subscription. Your email address becomes the contact address of a location you create unless you change it, so it is also shared with Stripe at checkout and used to send account email through Resend, and eleMusic staff who support your account can see it. We do not receive your Google password, we do not keep Google access or refresh tokens, and we do not access any other Google data. We do not use Google user data for advertising and do not sell it. Our use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. See our Privacy Policy. | See provider | policies.google.com/privacy |
| Google (Google Cast) | In the web player on Chromium-based browsers, after you pick a station. In the mobile apps, whenever the app is running, because Google's Cast software is built in. | In the web player, loading Google's Cast software exposes your IP address and browser type to Google. In the mobile apps, Google's Cast software may send Google diagnostic data, usage data when you use its casting controls, and a device identifier, and it looks for Cast devices on your local network (on iPhone and iPad, only after you tap the cast button and give permission). When you cast, the audio link and the track and station names go to the Cast device you choose, which runs Google's media receiver. | See provider | policies.google.com/privacy |
| Google Fonts | When you visit our separate marketing page, which loads fonts from Google's servers. | Your IP address and browser type when the page loads its fonts. | See provider | policies.google.com/privacy |
| Apple | When you download our iOS or iPadOS app; if offered, when you choose Sign in with Apple or buy a subscription in the App Store. | Apple's own download, crash report and purchase data. If you sign in with Apple, Apple gives us an account identifier, an email address (which may be a private relay address) and the name you share. | See provider | apple.com/legal/privacy |
| Google Play | When you download our Android app; if offered, when you buy a subscription through Google Play. | Google's own download, crash report and purchase data. | See provider | policies.google.com/privacy |
If we offer a subscription sold through the App Store or Google Play, Apple or Google processes the purchase and payment data as an independent party under its own terms, and it tells us only what we need to confirm and manage your subscription.
We do not receive payment or anything else of value for data these companies collect, and we do not allow them to use it to advertise to you on our behalf.
Certificate verification page. Each location has an Original Catalog Certificate with a public verification page. Anyone who has a location's certificate id or verification link, such as a music licensing organization you send it to, can see the practice name, city and state, the certificate status and its active periods. Share the link only with people you want to see that information.
5. Music generation
eleMusic's catalog is original music generated and mastered by eleMusic. We create it in advance with generative AI models, including third-party models. The companies that provide those models receive only the music instructions we write. We do not send them customer or user personal data, and we do not use customer personal data to make music or to train AI models. Model disclosures appear on each location's Original Catalog Certificate.
6. Changes to this list
We update this page, and change the "Last updated" date at the top, before a new or replacement provider receives customer personal data. Adding or replacing a provider for a purpose our Privacy Policy already describes is not a material change. If a change is material, we give the notice described in Section 18 of our Privacy Policy. If you do not agree with a change, you may stop using the service and cancel your subscription as described in our Terms of Service.
Earlier versions of this page are available on request.
7. Contact
Questions about this list or about how we handle personal data go to:
eleMusic Inc.Attn: Privacy
8 The Green, Suite B, Dover, Delaware 19901
hello@elemusic.fm