The fine print, in the open.

# Tunez AI - Privacy Notice

**Operator-authorized registration edition, 1 November 2026.**

Publication and effective dates are recorded with the served document version. Operator publication is not a recorded legal sign-off.

Responsible operator: ROLLTEK TECHNOLOGIES (OPC) PRIVATE LIMITED. CIN: U62099TN2023OPC158523. Listed registered office: 4/608, VOC Street, Perungudi, OMR, Chennai City Corporation, Tamil Nadu - 600041, India. Country of incorporation: India. Privacy/grievance contact: info@tunezai.com. Effective date: the date recorded with the approved published version; not a retrospective date. Initial self-registration is limited to adults aged 18 or older in India. Minor and guardian account creation remain closed. Uploads and participation remain unavailable in this release. Availability outside India requires a separate decision.

## 1. Data and purposes

Depending on the features you use, Tunez processes:

| Data | Purpose | | ---------------------------------------------------------------------- | ----------------------------------------------------------------- | | Email, display name, credentials and verification records | Account access, verification, security and account communications | | Date of birth, country, age-band and guardian/consent records | Eligibility and the applicable age and guardian safeguards | | Organization membership, roles and competition entries | Administration, participation and access control | | Uploaded audio/video, metadata and generated renditions | Storage, malware scanning, playback and performance processing | | Audio measurements, evidence bundles, scores and reviewer comments | Authorized assessment, result explanation and dispute review | | Sessions, security-event records, keyed IP hashes and operational logs | Authentication, abuse prevention and incident investigation | | Support messages, preferences and request histories | Support, communication preferences and privacy-request handling |

Provide only information needed for the service. A recording can include other people or personal information; obtain appropriate permission before uploading it. Account and eligibility information comes from you; invitation details may come from a participant or guardian; assessment records come from processing services and authorized reviewers. We do not ask for government identification in ordinary registration. Do not send identification by email.

We ask for acceptance of the Terms separately from acknowledgement of this Notice. Acknowledging a notice is not blanket consent to every purpose. Where consent is the applicable basis, it must be specific, informed and withdrawable. Essential account processing supports the service you request; security, record preservation and legal disclosures occur only where permitted or required by law. Optional sharing or practice-data processing requires the relevant separate permission. You may decline optional processing without authorizing it through account registration.

## 2. Audio analysis and human review

Software may extract technical measurements and generate analysis artifacts from recordings. Measurements can be unavailable or inaccurate. Authorized judges and organizers may also review submissions under event rules. Analysis may inform reviewer assessment, eligibility or scoring where an event's rules expressly allow it. It is not an independently certified judgment of talent. Competition entry and publication remain unavailable until event rules describe scoring and human review. Contact info@tunezai.com with an entry reference to challenge an assessment or request human review and an explanation. Do not infer that automated analysis identifies a person biometrically; any identity-recognition use would require separate assessment and disclosure.

## 3. Children and visibility

The intended minimum registration age is 13. People under 13 are not eligible, even with guardian permission. Registration for ages 13-17 stays unavailable until a reviewed guardian-first route provides verifiable permission for child personal-data processing before account collection, subject only to a separately assessed minimal preliminary process. Additional permission is required before participation or recording uploads. People aged 18 or older do not require guardian consent. The service may process guardian contact, verification, relationship and consent records to operate these safeguards. Account creation alone does not authorize a minor's recording processing or public sharing. Consent withdrawal and expiry must be handled under the reviewed child-data policy. If you believe someone under 13 has provided information, or required guardian consent is missing, contact info@tunezai.com for review. The existing invitation route confirms control of an email address and records an attestation; it does not independently establish the guardian's age or relationship. It must not be advertised as completed legal identity verification. No child-targeted advertising, behavioral tracking or unrelated model training is authorized by this notice. Music-performance analysis for minors needs a specific legal assessment; the label "educational" does not establish an exemption. The [Guardian Consent Notice](guardian-consent.en.md) explains the proposed separate scopes. Existing technical safeguards are not a certification of legal compliance. Public profiles, results and recording sharing still require the applicable permissions and visibility controls. General account registration does not authorize all public sharing.

## 4. Access, service providers and locations

Access is limited by role and purpose; authorized organizers, judges and administrators may receive information needed for their tasks. Public information depends on publication rules and permissions. Short-lived media-access links are intended for authorized access, but recipients should not forward them.

The configured deployment uses Supabase PostgreSQL for application records, Microsoft Azure Blob Storage for media and analysis artifacts, Azure Key Vault for configured key services, and Hostinger for application hosting and outgoing email. The VPS and database are configured in Mumbai; Blob and Key Vault resources are configured in Azure Central India. These region settings do not establish that all provider support, telemetry, email or backup processing stays in India. Providers process service data under their applicable agreements and may use subprocessors. Support, telemetry, email delivery and recovery operations may involve other locations. An India resource region is not an India-only processing guarantee. The operator must assess the applicable contracts and transfer safeguards before enabling a new provider or country. We do not sell personal data. We may disclose necessary records when lawfully required by an authority or to investigate a security, safety or rights complaint. Event organizers are responsible for their own additional processing and must supply any separate notice before collecting it.

## 5. Cookies, communications and optional processing

The service uses session and anti-forgery cookies for account access and security. Operational emails may cover verification, password resets, security and participation. Optional notifications depend on the applicable settings. Authentication and anonymous anti-forgery cookies are browser-session cookies unless persistent sign-in is selected. Server-side sessions also expire under the applicable role policy. Persistent sign-in expires within the configured maximum and can be ended through sign-out or session controls. Display preferences may be stored locally on your device. Blocking essential cookies can prevent sign-in or secure submissions. This notice does not authorize analytics, advertising cookies, marketing lists or additional third-party tracking; those require a separate inventory, disclosure and any applicable opt-in before deployment. The configured deployment selects template feedback, not external LLM-generated feedback. Review any future external AI or model-training use before enabling it; this notice does not authorize it.

## 6. Retention and deletion

Account information is needed while the account remains active. On a verified closure request, credentials and unnecessary profile information are removed or pseudonymized through the applicable workflow. Restricted consent and security evidence may remain to document authorization, resolve an open complaint, investigate an incident or satisfy an applicable legal obligation. Media and assessment records remain only while needed for an authorized feature, event, appeal or documented legal hold. An event must disclose its retention criteria before collecting recordings. Support correspondence is needed until the request and any associated complaint are resolved. Retained records must not be reused for a new optional purpose.

The proposed operational time limits and implementation checks are recorded in the [Guardian and Eligibility Decision](guardian-consent-decision.md). They are not claims that automatic expiry already operates. The operator must implement or revise those limits before publication.

The application supports deletion and pseudonymization workflows. Submitted/scored records, consents, appeals, audit records and records under a legal hold may be retained for an applicable documented purpose. Account closure can remove credentials while leaving a pseudonymized user record. Pseudonymization is not necessarily anonymization or complete erasure. Soft-deleted or backed-up copies may persist until their approved expiry; restoration must not silently reactivate an account whose deletion request remains applicable. Do not promise immediate deletion of every copy.

At the latest inspected configuration, Supabase Pro provides daily backups with seven-day access. Azure quarantine soft delete is seven days; processed storage has 30-day soft delete and versioning configured to keep all versions. Historical media versions therefore have no automatic expiry currently demonstrated. These settings are recovery protections, not evidence of deletion compliance. Access to retained recovery data must be restricted and expired data must not be restored to active use. Full-system restoration and deletion reconciliation have not been demonstrated.

## 7. Requests and complaints

Contact the privacy/grievance address to request information about your data, correction, access, export, closure, consent withdrawal or other rights applicable to your jurisdiction. The operator may need to verify the requester's authority without collecting unnecessary additional information. Explain any applicable restriction, retained category and review route. Use info@tunezai.com and describe the request without including a password. A parent or legal guardian may request review of a child's account or withdraw a permission, subject to proportionate authority checks. A disputed relationship must not be resolved merely by disclosure of the child's records. We aim to acknowledge requests within seven days and provide a substantive response within 30 days of adequate verification, or explain the reason for more time. These are proposed service targets, not a substitute for a shorter statutory deadline. Where a request cannot be fully met, explain the restriction and available review route. You may use the competent regulator, tribunal or court where the applicable complaint procedure is available. No newly enacted right is represented as already commenced merely by appearing in this notice.

## 8. Security and incidents

The deployment uses access controls, authenticated transport and encryption features provided by its storage/database infrastructure. No system is perfectly secure. Do not claim that every sensitive application field is encrypted with Key Vault: that integration has not been demonstrated. Report suspected incidents to the monitored contact. The operator coordinates containment, evidence preservation, provider contact and risk assessment. Where applicable law requires notice to affected people or an authority, it must give that notice within the applicable deadline and communicate appropriate protective steps. Email info@tunezai.com to report a suspected incident; do not attach passwords or live access tokens.

## 9. Updates

Version this notice and communicate material changes before new processing where required. Obtain new consent where necessary; do not repurpose existing recordings based only on updated wording.

# Tunez AI - Terms of Service

**Operator-authorized registration edition, 1 November 2026.**

Publication and effective dates are recorded with the served document version. Operator publication is not a recorded legal sign-off.

Operator: ROLLTEK TECHNOLOGIES (OPC) PRIVATE LIMITED. CIN: U62099TN2023OPC158523. Listed registered office: 4/608, VOC Street, Perungudi, OMR, Chennai City Corporation, Tamil Nadu - 600041, India. Country of incorporation: India. Effective date: the date recorded with the approved published version. Do not backdate acceptance. Support and legal contact: info@tunezai.com.

## 1. What Tunez provides

Tunez provides accounts, music-performance submissions, competition administration, human review and automated audio-analysis features. Features available to you depend on the event, your role and the published rules. Automated measurements may be incomplete or inaccurate; they are not a guarantee of artistic quality, eligibility, prizes or a particular result.

## 2. Eligibility and accounts

Use accurate information when registering and keep your credentials private. Do not share accounts, impersonate another person or evade a suspension. Notify the support contact if you suspect misuse. Participation depends on the applicable eligibility policy and event rules.

The intended minimum age is 13, subject to the supported-country and guardian-verification requirements. People under 13 are not eligible, even with guardian permission. People aged 13-17 may register only when the operator makes a legally reviewed guardian-onboarding route available; until then minor registration remains unavailable. A guardian must give verifiable permission for the child's personal-data processing before that route collects the child's account information, except any narrowly necessary preliminary processing that has been separately legally assessed. Adults aged 18 or older do not require guardian consent. Registration alone is not guardian consent or permission to upload, analyze or publicly share a minor's recording. Required guardian verification and consent must be completed through the service's applicable workflow. Withdrawal or expiry of required consent restricts further processing and access according to the reviewed policy; it does not promise immediate deletion of retained records. Initial self-registration is limited to adults aged 18 or older in India. Minor and guardian account creation remain closed. Uploads and participation are not opened by this registration release. Registration elsewhere is unavailable unless expressly enabled under a country-specific eligibility decision. A country selector is not permission to participate. An email link confirms mailbox access, not independent proof of adulthood or parental authority. See the [Guardian Consent Notice](guardian-consent.en.md) for separate permissions and withdrawal. If use by someone under 13 or missing guardian consent is reported, contact support so the operator can review access and handle associated data appropriately.

## 3. Your recordings and other content

You retain rights you own in your submissions. Upload only content you have permission to use, including any music, backing tracks, performances and recordings involving other people. Do not upload unlawful material, malware, harassment or another person's confidential information.

For operating the service, you grant the operator a non-exclusive permission to store, copy, transcode, scan, analyze and make your content available to authorized participants, reviewers and administrators for the purposes described in the Privacy Notice and the relevant event rules. Public display or promotion must follow the applicable visibility settings and permissions; this operational permission is not a blanket authorization to advertise with your likeness.

This permission applies worldwide only to the extent necessary for the disclosed service providers and authorized service access. It lasts while the content is used for those purposes and for any restricted lawful retention described in the Privacy Notice. It ends for new optional uses when you withdraw the relevant permission or close your account. It does not transfer ownership, permit sale of your recording or excuse the operator or organizer from obtaining music licences they require. No permission for unrelated AI-model training is granted; any proposed training use requires separate review and disclosure before implementation.

## 4. Competitions, scoring and disputes

Read each event's published eligibility, submission, rubric, judging, result and appeal rules. Those rules must explain how automated measurements and human judgment are used, what happens when a measurement is unavailable, and the process and deadline for challenging a result. An automated score must not be described as an infallible or independently certified assessment. Do not manipulate recordings, submit another person's performance or interfere with judging.

Account registration does not enter you into a competition or entitle you to a prize. Competitions, uploads and public results remain unavailable until their rules and access controls are separately released. Before entries open, the organizer must publish submission deadlines, eligibility, scoring, human review, appeal deadlines, prize conditions and any fees or refunds. Do not pay an entry fee unless an approved payment flow and written event terms are available. To report a scoring or eligibility concern, contact info@tunezai.com with the event and entry reference. Request human review; automated output is not the only basis for resolving a disputed outcome. An event's deadline cannot remove a right or remedy provided by applicable law.

## 5. Moderation and account restrictions

The operator may restrict access or content to address misuse, security threats, rights complaints or applicable legal requirements. Where appropriate and permitted, explain the reason and provide a way to request review. Restrictions do not authorize deletion of records subject to a legal hold. To report misconduct or a rights issue, email info@tunezai.com with a description, the affected content reference and the basis of your complaint. Do not email passwords or unnecessary identity documents. You may request review of a restriction through the same address. The operator will assess the complaint and explain its decision where lawful; it may act urgently before notice for security, child safety or legal reasons. Reporting a complaint does not guarantee removal of lawful content.

## 6. Privacy and account closure

The Privacy Notice describes personal-data processing and the available request procedures. Closing an account does not necessarily erase competition, consent, appeal or audit records. Some records may be retained or pseudonymized for a documented lawful purpose; the operator must explain applicable retention periods and restrictions rather than promise immediate complete erasure.

## 7. Availability and responsibility

Maintenance, provider outages or processing failures may interrupt the service. Keep your own copy of recordings; do not rely on Tunez as your only archive. The service is developing and no uninterrupted availability, particular score or competition outcome is promised. The operator must still meet duties imposed by applicable law and exercise reasonable care in operating the service. These terms do not impose a blanket user indemnity or a fixed liability cap. Responsibility for a proven loss is determined under applicable law. Nothing excludes mandatory consumer rights or liability that cannot legally be excluded.

## 8. Changes and applicable law

Material changes require an appropriate notice and, where necessary, renewed acceptance or consent. Keep prior versions and acceptance evidence; do not silently change a document users already accepted. Material updates will be notified through the service or the registered email before they apply, except urgent changes required for security or law. Where renewed acceptance or consent is required, the affected feature remains unavailable until it is obtained. Changes are not retrospective permission to use previously submitted content for unrelated purposes.

These proposed terms are governed by Indian law, subject to mandatory protections applicable to you. Contact info@tunezai.com first to seek resolution of a dispute. Courts and statutory authorities with jurisdiction under applicable law remain available; no exclusive forum, compulsory arbitration or waiver of a statutory complaint right is imposed by these terms.

[TO CONFIRM — D03] DEV ONLY placeholder privacy notice for local development. Your date of birth and country are used only to work out your age band; minors are private by default. This is not a legal document.

[TO CONFIRM — D03] DEV ONLY placeholder terms of service for local development. This is not a legal document and grants or takes away no rights. The real terms are published only after legal review.