Privacy Policy | Riverstarz Studio OS
Riverstarz Logo RIVERSTARZ
Sign In
Data Protection Kenya DPA 2019 Compliant
Back to Sign In

Privacy Policy

Riverstarz Music Entertainment is dedicated to safeguarding your personal data and privacy rights in full compliance with the Kenya Data Protection Act, 2019 and global privacy standards.

01

Scope & Overview

This Privacy Policy describes how Riverstarz Music Entertainment collects, uses, discloses, and protects personal data obtained through riverstarz.com, all subdomains, distribution tools, SmartLinks, and associated services.

By accessing or using our platform, you acknowledge that you have read and understood this Privacy Policy and consent to our processing of your personal data as described herein.

02

Information We Collect

We collect personal data required to deliver music distribution services, disburse earnings, verify identities, and secure our network:

  • Profile & Contact Data: Legal name, artist alias, email address, password hash, phone number, and physical address.
  • Verification & Financial Information: M-Pesa registered phone numbers and official name records for payout verification, tax IDs, and double-entry royalty accounting ledgers.
  • Catalog Metadata: Song titles, audio masters (WAV/FLAC), cover artwork, ISRC, UPC, songwriter details, contributor roles, and revenue split allocations.
  • Technical & Usage Logs: IP address, device type, browser identifiers, session security tokens, access timestamps, and request logs.
03

Legal Grounds for Processing

Under the Kenya Data Protection Act, 2019, we process personal data under the following lawful bases:

Contractual Necessity

Delivering music to DSPs, processing payouts, managing catalog metadata, and executing royalty splits.

Legal Compliance

Fulfilling tax obligations, financial audits, copyright enforcement, and lawful court orders.

Legitimate Interests

Preventing streaming fraud, protecting platform security, and improving platform user experience.

Explicit Consent

OAuth pre-save campaign authorizations or direct marketing communications.

04

Data Sharing & Third-Party Services

We do not sell personal data. We share data strictly with trusted service providers essential to operations:

  • Digital Service Providers (DSPs): Apple Music, Spotify, YouTube Music, Amazon Music, Boomplay, Audiomack, TikTok, and DDEX partner networks.
  • Payment & Telecom Operators: Safaricom PLC for automated mobile money payout disbursements and payment notifications.
  • Infrastructure & Cloud Storage: AWS S3 (for encrypted master audio/artwork storage with presigned URLs) and transactional email systems.
05

Data Security & Retention Policies

We employ TLS 1.3 encryption for data in transit, encrypted storage drivers, strict role-based access control, and secure presigned asset access URLs.

Financial ledger entries, payout records, and transaction histories are retained for a statutory period of seven (7) years in accordance with Kenyan accounting regulations. Account profile data is retained for the duration of your active relationship with Riverstarz.

06

Your Data Subject Rights

Under the Kenya Data Protection Act, 2019, you possess the right to access, rectify, port, restrict, or request erasure of your personal data where retention grounds no longer apply.

To exercise your rights, contact our Data Protection Officer at privacy@riverstarz.com. You also have the right to lodge a complaint with the Office of the Data Protection Commissioner (ODPC) in Kenya.