Privacy Policy

Who we are

lblOS helps record labels manage their work. This policy explains how we use personal data across the lblOS application, website, support, demo booking and recruitment services (the “Services”), who may receive it and the choices you have.

The Services are operated from Kazakhstan by RetailApps KZ LLP, a limited liability partnership registered in the Republic of Kazakhstan under Business Identification Number (BIN) 221040038450, with its registered office at 1/96 Kurmangazy St., apt. 25, Medeu District, Almaty 050010 (“lblOS”, “we”, “us”). For questions about this policy or your data, contact us at info@mgmtos.io.

Controller and processor. For the account, profile, billing, usage, support, booking and recruitment data we collect to run the Services, lblOS is the data controller. For the content you and your team create inside a workspace, the organization that owns the workspace is the controller and lblOS acts as a processor handling that content on the organization’s instructions. If you use lblOS as part of an organization, that organization’s administrators control your workspace data and you should also consult their privacy practices.

We do not sell personal data, we do not share it for cross-context behavioral advertising, and we use it for the purposes described in this policy.

Data we collect

• Account and billing information: your name, email address, sign-in identity, organization, subscription and billing status. Payment details are collected by the payment service identified at checkout.
• Workspace content: artists, releases, contacts, tasks, messages, attachments and financial information that you or your organization provide.
• Communications and bookings: contact details, questions, messages, files and meeting information you share with us.
• Job applications: your CV, contact information, professional experience, qualifications, corrections and any additional information you choose to provide.
• Information from services you connect: account details, permissions and content needed for the connection you choose. For Google Sheets, Notion or Airtable imports, this includes the sources you select. The permissions offered by a connected Google account may cover all its spreadsheets; we use the selected sources for your requested import.
• Usage and device information: pages and features used, browser and device details, connection information, security records, errors, and your privacy preferences. Optional analytics and recordings are described below.

These may include identifiers, customer records, commercial information, professional information, internet activity and information derived from content you provide. We use sign-in credentials only to authenticate access and protect accounts. Please do not provide unrelated sensitive personal information.

Providing personal data is voluntary. We need relevant account, contact or application information to provide the service you request; if you do not provide it, we may be unable to do so.

How we use your data

• To provide your account and workspace, collaboration, imports, connected features, billing and support.
• To respond to messages, arrange meetings and send necessary service, account and billing notices.
• To consider job applications, communicate with candidates and manage recruitment.
• To provide the AI assistance you request, such as understanding uploaded content or preparing suggestions for your review. This may involve specialist service providers processing the content needed for that feature.
• To keep the Services reliable, prevent abuse and improve the product, with consent where required.
• To meet legal, tax and accounting obligations and establish, exercise or defend legal claims.

We do not train lblOS models on your workspace content. Connected Google Sheets import data is not sent to our automated spreadsheet analysis providers. Our use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements. We do not make decisions with legal or similarly significant effects, including hiring decisions, solely through automated processing.

Legal bases (EEA / UK)

If you are in the European Economic Area or the United Kingdom, we rely on the following legal bases under the GDPR and UK GDPR:

• Performance of a contract and steps you request before entering a contract (Art. 6(1)(b)). Providing the Services, managing your account, arranging meetings and considering an application for employment.
• Legitimate interests (Art. 6(1)(f)). Securing the Services, preventing fraud and abuse, and understanding aggregate usage to improve the product. We balance these interests against your rights and you may object at any time (see below).
• Consent (Art. 6(1)(a)). Optional analytics, requested AI analysis of your CV and marketing messages, where consent is required. You may withdraw consent at any time without affecting prior processing.
• Legal obligation (Art. 6(1)(c)). Retaining invoices and financial records and responding to lawful requests.

Cookies and analytics

Necessary cookies and similar storage keep you signed in and remember your preferences. Optional analytics help us understand visits, feature use and service performance. With permission where required, recordings of interactions help us understand usability; personal details and form answers are hidden or excluded.

You can decline optional analytics and continue using the Services. Use Analytics preferences on the website or the privacy controls in the application to change your choice. Withdrawing consent stops future optional collection; it does not automatically erase information already collected.

We also keep limited service and security records to operate and protect the Services. We honor Global Privacy Control. Browser Do Not Track signals are not separately supported.

Who processes your data

We share data only where needed for the purposes described in this policy. Recipients include:

• Service providers for hosting and storage, account access, communications, payments, customer support, analytics, security and automated content assistance. They receive the information needed for the services they provide.
• Your organization and authorized collaborators, according to the workspace access you or your organization choose.
• Third-party services and assistants you choose to connect, within the access you approve. Their own privacy policies also apply.
• Professional advisers, authorities or other parties where necessary to meet legal obligations, protect rights or complete a business transfer. We will provide notice where required.

You may request further information about recipients and relevant safeguards at info@mgmtos.io. We do not sell personal data or share it for cross-context behavioral advertising.

International and cross-border transfers

We operate from Kazakhstan and use service providers in the United States and the European Union. Your data may therefore be processed outside the country where you live. Transfers must comply with applicable data protection requirements. Where consent is required under Kazakhstan law, you may withdraw it by contacting us; this may affect services that depend on the transfer.

For transfers originating in the EEA or the UK, we rely on a European Commission or UK adequacy decision where one applies (including the EU–US Data Privacy Framework and its UK Extension for certified recipients) and otherwise on the European Commission’s Standard Contractual Clauses together with the UK International Data Transfer Addendum, with additional safeguards where required. You can obtain a copy of the relevant safeguards by emailing info@mgmtos.io.

Data retention

We keep account and workspace information while it is needed to provide the Services. Account deletion removes your account from the Services; it does not offer a recovery period. We retain information beyond that only where needed for legal obligations, security or legal claims. Residual backup copies are removed through the normal backup lifecycle and are not used for ordinary product access.

Temporary deletion records include member email addresses used to send deletion confirmations. We erase these records within seven days after deletion completes. These records do not restore product or account access.

Unsubmitted CVs and draft applications are retained for seven days. Submitted applications and their CVs are retained for 180 days. To request earlier deletion, contact info@mgmtos.io from the email address in your application.

Security, service and analytics information is kept for the period needed for its purpose, taking account of sensitivity, security needs and applicable retention settings. Website analytics choices and related cookies may remain for up to 180 days. Invoices and other legally required records are retained for the period required by applicable law.

Security

We use technical and organizational measures designed to protect personal data against unauthorized access, loss and misuse. Access is limited according to responsibility and permission. No service can guarantee absolute security.

Your rights

Depending on where you live (including under the GDPR, UK GDPR, the California Consumer Privacy Act, and Kazakhstan’s Law on Personal Data and its Protection) you may have the right to access the personal data we hold about you, correct it, export it in a portable format, request deletion or blocking, restrict or object to certain processing, and withdraw consent where consent is the legal basis.

• Access and export. You can export your workspace content as CSV from the app at any time, and you can request a full copy by email.
• Correction and deletion. You can edit your data and request account deletion in the app. Recruitment deletion requests can be sent to info@mgmtos.io. Applicable retention periods and legal exceptions are described above.
• Other requests. Email info@mgmtos.io from the address tied to your account and we will action the request within a reasonable time at no cost. We may need to verify your identity first.

You may also lodge a complaint with your local supervisory authority. In the EEA this is your national data protection authority; in the UK it is the Information Commissioner’s Office.

California privacy rights

If you are a California resident, you have the right to know what personal information we collect and how we use and disclose it, to request access to or deletion of that information, to correct inaccurate information, and not to be discriminated against for exercising these rights.

We do not sell your personal information, and we do not share it for cross-context behavioral advertising. We have not sold or shared personal information in the preceding twelve months. To exercise a request, email info@mgmtos.io; you may use an authorized agent, and we will verify your identity before acting on a request to know or delete.

Kazakhstan data subjects

If your personal data is processed under the law of the Republic of Kazakhstan, you have the rights set out in art. 24 of the Law on Personal Data and its Protection: to know that your data is being processed, to demand its correction, blocking, or destruction, to withdraw your consent, and to seek compensation for harm. You can give or withdraw consent and see which operators hold access through the state personal-data access-control service on egov.kz and via the 1414 contact center.

The authority responsible for personal-data protection is the Committee for Information Security of the Ministry of Artificial Intelligence and Digital Development of the Republic of Kazakhstan, to which you may also submit a complaint.

Children's privacy

The Services are intended for adult professionals working in the music industry and are not directed to children. We do not knowingly collect personal data from anyone under the age at which consent is valid in their country (16 in much of the EEA, 13 in the United States). If you believe a child has provided us with personal data, contact us and we will delete it.

Third-party sites and integrations

When you connect a third-party service or assistant, it may receive workspace information needed for the actions you authorize, including records, files or financial information within your approved access. Review the access request and that service’s privacy policy before connecting.

You can revoke a connection in the application to stop future access. Revocation does not remove information the connected service has already received. Contact that service about its retained copies.

This policy does not cover third-party sites or services that we do not control.

Changes to this policy

We may update this policy as the Services change. We will update the effective date and provide additional notice of material changes where required. Where a new use of your data requires consent, we will ask before that use begins.

Contact

For privacy questions, data requests, or anything else covered by this policy, email info@mgmtos.io. We aim to respond within seven business days.