Privacy Policy

This Privacy Policy is made pursuant to art. 13 of the European Regulation n. 679/2016 and applies exclusively to all data collected through the website www.audaciainnovations.com and related to the mobile and Celia (hereinafter “Website“), the Audacia Innovations web app for music artists, managers, and record labels, available at https://celia.audaciainnovations.com. Hereinafter, the website and the app are collectively referred to as the ‘Website’; the app, also referred to as the ‘Celia – AI Co Manager’ service, is referred to as ‘Celia

This Privacy Policy is subject to updates which will be published promptly on the website at the following link www.audaciainnovations.com/privacypolicy

The Privacy Policy together with the Cookie Policy, present the bases on which the User’s Personal Data will come.

Data Controller

The Data Controller of each data and informations collected from this website is Audacia Innovation S.r.l. with registered office in Via Eumelo 32, 96100, Siracusa, CF/Vat number  02062520891 email address: legal@audaciainnovations.com

Methods of processing

The Personal Data provided or acquired will be processed based on principles of correctness, lawfulness, transparency and protection of confidentiality in accordance with current regulations.

The Data Controller processes the Personal Data of users who adopt the appropriate security measures to prevent unauthorized access, disclosure, modification or destruction of the Personal Data.

The processing is carried out using IT and / or telematic tools, with methods strictly related to the purposes indicated.

Personal data can be collected independently by the owner or through third parties.

We only collect information that we actually need.

Some of these informations that are provided by Users while registering an account, while asking for a customer support or while asking some informations.

When the User visits one of our websites or uses the Controller’s software, it automatically records some basic information on how the User arrived at the site, where he navigated it and what features and settings he used.

The Data Controller uses this information for websites and services and to improve the development of new products. Sometimes the Data Controller receives information indirectly.

If the User asks about the Controller’s products through one of the referral programs or resale partners, or accessing one of the products through an authentication service provider such as LinkedIn or Google, they will transmit the relevant contact information to the Data Controller.

If you interact with the Data Controller’s brand on social media (for example, by liking it, by commenting, retweeting, quoting or following it), the Data Controller will have access to User interactions and profile information.

It will still retain this information even if it is later removed from the social media website.

The Data Controller uses the information to provide the requested services, create and maintain the account and monitor unauthorized activities on the account.

They will also be used to communicate with the User about the products he is currently using, any customer support requests, new products, the possibilities for the User to provide feedback and updates to the rules.

The Data Controller analyze the information that we collect to understand user needs and to improve our websites and services.

The Data Controller is required to have a legal basis for the collection and processing of information and data.

You may refuse certain types of use by not providing the information or by opting out later.

It is also possible to disable cookies to prevent the browser from providing information, but in this case some features of the website may not work properly.

If the Data Controller share the information with other parties (such as service providers, domain registrars and resale partners), they must have appropriate security measures and a valid reason to use the information.

The European Economic Area (EEA) guarantees certain rights to data subjects (including access, rectification, cancellation, limitation of processing, data portability and the right to object and request). Audacia is committed to providing the same rights regardless of the territory of origin of the user.

The Data Controller keeps your personal information for as long as it0s necessary only for the purposes indicated in this Privacy Policy.

Types of personal data collected

The Personal Data may be provided deliberately by the User while using the website, when filling in the contact form, subscribing to the newsletter, by registering, by means of various contracts and by token, or while communicating with the Data Controller via mail or by telephone.

The Personal Data provided or acquired can be of various types including:

• Contact details (eg. name, residence, telephone number, date of birth, gender, e-mail address);
• Data relating to the e-mail (eg. The number of times the e-mail has been opened);
• Details of payment and billing details;
• Profile images used in the various platforms and posted on social networks;
• Token;
• Statistics provided by platforms, such as the number of streams, the number of subscribers, posts and engagement, the socio-demographic data of each User;
• data relating to the User’s social media accounts and linked digital platforms, including account identifiers, analytics data, insights, content performance, engagement data and metrics relating to published content;
• content, multimedia materials, text, images, videos, captions, hashtags and information uploaded or input by the User while using “Celia”.

The optional, explicit and voluntary sending of e-mails through the contact forms or by means of the addresses indicated on this Website, entails the subsequent acquisition of the sender’s address, necessary to respond to requests, as well as any other Personal Data included in the e-mail.

The consent to the provision of Data by the User is necessary to be entered in the Data Controller’s database and for the purpose of establishing and correctly carrying out what is offered by the same to its Users, as well as to third parties for the fulfillment of the single activity requested.

Failure to provide such Data, therefore, prevents registration in the Data Controller’s databases, the completion of any contracts, as well as the execution of the slatter and any other possible activity.

Therefore, failure by the User to provide some Personal Data may prevent this Website from providing its services.

 The User assumes responsibility for the Personal Data of third parties published or shared through this Website and guarantees to have the right to communicate them, exempting the Owner from any liability to third parties.

Specific summary information will be progressively reported or displayed on the pages of the Website to set up particular services on request.

Communication and utilization of data

In addition to the Data Controller, in some cases, third party may have access to the Data such as:

1. a) in charged persons involved in the organization of the website (administrative, commercial, marketing, legal, system administrators);
2. b) external parties (such as third party technical service providers, hosting providers, IT companies, communication agencies) also appointed as Data Processors by the Data Controller pursuant to art.28 GDPR. The updated list of such Data Processor, if appointed, can always be requested from the Data Controller;
3. c) public or private subjects who can access the Data in compliance with legal obligations;
4. d) subjects who perform ancillary services and tasks with respect to the activity carried by the Owner;
5. e) Website Users who may view certain Public Profile Data while posting a product review;
6. f) external parties such as partners in the organization of initiatives and events promoted and / or sponsored by the Data Controller to whom the communication of the Data is necessary for organizational reasons.

Territory

The Data are processed at the Data Controller’s operational headquarters. For more information, you can contact the Data Controller.

Data recipients and data transfer abroad

Personal Data may be processed at the operational premises of the Data Controller and/or third-party suppliers duly appointed as Data Processors pursuant to Article 28 of the GDPR, located both within and outside the European Economic Area (EEA), where this is necessary for the provision of the services offered via the Website, including cloud services, hosting platforms, analytics tools, API services, social media platforms, automation systems and technologies based on artificial intelligence. Every transfer outside the European Economic Area (EEA) is carried out in accordance with the safeguards provided for under Chapter V of the GDPR.

The Data may be disclosed to third parties to comply with legal obligations, to comply with orders from public authorities or to exercise a right of the Data Controller in front of judicial authorities.

The management of databases and the processing of data are related to the purposes of the processing and are carried out in compliance with the applicable legislation on data protection.

Purpose of processing the collected data

User’s Data is collected to allow the Website to provide its services, as well as for the following purposes:

1. a) for purposes related to the legitimate interest of the Data Controller;
2. b) to fulfill the obligations arising from the contract stipulated between the User and the Data Controller for the sale of the packages on the Website and to provide the information requested by the User. This treatment is mandatory for the execution of the contract of which the User is a party, for the execution of pre-contractual measures or to fulfill a legal obligation to which the Data Controller is subject;
3. c) to fulfill any type of obligation contemplated and envisaged by current laws, regulations, related regulations and commercial uses, in particular, in tax / fiscal matters. This treatment is mandatory to fulfill a legal obligation to which the Data Controller is subject;
4. d) to follow up on the specific requests addressed to the Data Controller by the User through the Website and (Contact form, information request forms, email) and for communications of an informative nature relating to the products of the same Data Controller, following the request of information via e-mail messages or filling out the contact form and other communication tools.

This processing is optional and based on the User’s consent, however failure to communicate one or more Data will make not possible to respond to the request and to use the services offered by the Data Controller;

1. e) for sending information and promotional and commercial offers through the newsletter service. This treatment is based on the consent freely expressed by the User;
2. f) for profiling activities for marketing purposes. This treatment is based on the consent freely expressed by the User;
3. g) to carry out statistical analysis in pseudonymised form in order to analyze the User’s behavior, habits and propensity to consume to improve the products and services provided by the Data Controller as well as meet the User’s expectations,
4. h) for the provision of the “Celia” service, including the automated development of digital promotion strategies for releases, singles, albums and music catalogues, the generation of personalised editorial calendars, the analysis of digital and social media channel performance, the formulation of suggestions regarding content to be published (including captions, hashtags, creative descriptions, images and videos), as well as the automated publication of content approved by the User on third-party platforms such as, for example, TikTok, Instagram and YouTube.

Use of Artificial Intelligence systems

In order to prepare analyses, plans, and recommendations, Celia sends only the data necessary for each individual request to an artificial intelligence model provider (OpenAI): statistics from connected platforms, public profile information (display name, username, profile link), and the text entered by the User in the project details section. Passwords, access tokens, and other credentials are never transmitted.

The provider processes the data as a Data Processor Responsible pursuant to Article 28 of the GDPR. As the provider may process data outside the European Economic Area (EEA), any such transfers are carried out in accordance with the safeguards provided for under Chapter V of the GDPR.

The results are recommendations: the User decides whether and how to implement them. In the service plans that include human involvement (AI + H and AI + H + C), the results are reviewed by the Audacia team before delivery. Celia does not make decisions based solely on automated processing that produce legal effects concerning the User (Article 22 GDPR).

Nature of the data processed and consequences of any refusal

The provision of browsing data by Users, for the above purposes, depends on the degree of privacy that the User has enabled or disabled through their browser.

In some cases, disabling may affect navigation on this Website.

For certain modules of this website, the provision of navigation data and / or the use of technical cookies is mandatory for the proper functioning of the site. The provision of some personal data is in any case necessary for the structure of the website itself and its procedures.

Processing times

The Data are kept for the time necessary to process them in relation to the performance of the service requested by the User, or required by the Purposes described in this document.

In particular:

– The Data collected for purposes attributable to the legitimate interest of the Data Controller will be retained until this interest is satisfied;

– The Data collected on the basis of the User’s consent may be kept until such consent is revoked;

– The Data collected for fiscal / administrative obligations or contractual obligations will be kept for the time necessary to carry out the aforementioned purposes and in accordance with the provisions of the law, for a period not exceeding that dictated by civil law and in any case for a period not exceeding at 10 (ten) years;

– The data collected for marketing and profiling purposes will be kept for a period not exceeding 24 (twenty-four) months from the acquisition of consent.

The Data may be kept by the Data Controller for a longer period in compliance with legal obligations, by order of an authority or for legitimate interest.

The User can always request the interruption of the processing or the cancellation of the data.

Data received from TikTok is stored and deleted as described in the ‘Celia and Connected Platforms’ section.

Cookies

This website uses cookies. Cookies are small text files that can be used by websites to make the user experience more efficient and to personalize content and ads.

Please refer to the more detailed Cookie Policy link: https://www.audaciainnovations.com/cookie-policy/

Security measures

This website has an SSL certificate and uses the HTTPS protocol to make sure the moment in which Personal Data is entered. With the use of this protocol, the transactions and data that are transmitted on the websites take place more safely and the content of the communication is not read or manipulated in any way by third parties.

Interaction with Social Networks

These services allow interaction with social networks or other external platforms directly from the pages of this Website.

The interactions and information acquired from this Website are in any case subject to the User’s privacy settings relating to each social network.

In the event that an interaction service with social networks is installed, it is possible that, even if the Users do not use the service, it collects traffic data relating to the pages in which it is installed.

Below some types of social networks:

1. a) Facebook (Facebook Ireland Ltd.)

The Facebook buttons are services for interacting with the Facebook social network, provided by Facebook Ireland Ltd.

Personal Data collected: Cookies and Usage Data. Place of processing: Ireland.

1. b) Instagram (Facebook Ireland Ltd.)

The Instagram buttons are services of interaction with the Instagram social network, provided by Facebook.

Personal Data collected: Cookies and Usage Data. Place of processing: Ireland

1. c) Spotify
2. d) Youtube
3. e) Tiktok

Use of YouTube API Services

This Website uses YouTube API Services to provide certain features and functionalities related to YouTube content and analytics.

By using our services, you acknowledge and agree that the Data Controller may access, collect, and process data from your YouTube account through YouTube API Services, including but not limited to channel statistics, views, subscribers, and audience data.

Access to such data is granted exclusively with your explicit authorization via OAuth 2.0 authentication.

All YouTube API access is performed exclusively on behalf of the authenticated channel owner, using OAuth 2.0 authorization granted by you through our Website.

The Data Controller uses this information solely to provide and improve its services for managing and optimizing digital content and presence.

Users may revoke access to their YouTube data at any time by visiting the following page:

https://security.google.com/settings/security/permissions

For more information on how Google processes personal data, please refer to the Google Privacy Policy:

https://policies.google.com/privacy

Use of YouTube API Services is also subject to the YouTube Terms of Service:

https://www.youtube.com/t/terms

Celia and Connected Platforms

Celia reads data from the platforms that the User chooses to connect, only after obtaining the User’s explicit authorization and always on a read-only basis. Celia does not publish, modify, or delete content on any of these platforms.

Celia reads and analyzes data from the following platforms:

– Spotify for Artists: Data on listeners, streams, saves, playlist additions, and audience demographics relating to the User’s project. Access is granted when the User invites data@audaciainnovations.com to the team associated with their Spotify for Artists profile and can be revoked by removing this address from the team.

– Instagram (professional accounts only, via Instagram Login): Profile information, followers, posts, and related statistics.

– YouTube (via Google Login and the YouTube API Services described above): Channel and video statistics.

– TikTok (via TikTok Login Kit): With the User’s authorization, Celia receives the following data from TikTok:

• Profile data: Account identifiers (open_id and union_id), display name, profile picture, and profile link.
• Account statistics: Number of followers, likes received and videos.
• Most recent public videos: Video identifiers and numbers of views, likes, comments, and shares.

Celia does not receive the User’s TikTok password, read private messages or content, or access data belonging to other TikTok users.

The TikTok APIs are used to display these statistics in the artist’s dashboard within Celia, analyze performance trends, calculate growth targets, and prepare reports and recommendations for the User.

These statistics are accessible to the User, individuals authorized by the User to access the artist’s dashboard (such as a manager or record label), and Audacia personnel involved in providing the service. The data is processed on behalf of Audacia by hosting, database, and artificial intelligence service providers appointed as Data Processors pursuant to Article 28 of the GDPR. These statistics are not sold, used for advertising or profiling for marketing purposes, or disclosed to any other third parties.

Regarding security, access tokens issued by TikTok are stored in encrypted form (AES-256) and are used exclusively by Celia’s servers.

Data is retained for as long as the TikTok account remains connected to Celia. If the User disconnects TikTok, Celia immediately revokes authorization with TikTok, deletes the access tokens and profile data, and deletes the collected statistics within 30 days. If the authorization expires or is revoked through TikTok’s settings, the statistics are deleted within 30 days of the last data collection.

The User may disconnect their TikTok account and request its deletion through the “Platforms and Access” page in Celia by clicking the “Disconnect” button, through the authorized apps section in the TikTok app settings, or by emailing legal@audaciainnovations.com. Requests submitted by email are processed within 30 days.

Payment management

The payment management services allow this Website to process payments by credit card, bank transfer or other tools.

The data used for payment are acquired directly by the requested payment service manager without being processed in any way by this Website.

Some of these services may also allow the scheduled sending of messages to the User, such as emails containing invoices or notifications regarding payment.

Further information

Upon request of the User, in addition to the information contained in this Privacy Policy, this Website may provide the User with additional and contextual information regarding specific services, or the collection and processing of Personal Data.

More information in relation to the processing of Personal Data may be requested at any time from the Data Controller using the contact information.

Exercise of the rights

The interested party has the right to exercise the rights provided in Articles 7, 15-22 of the European Reg. 679/2016. In particular, he has the right to:

• withdraw his/her consent at any time;
• request access to Personal Data;
• receive the personal data provided to the Data Controller and where possible transmit them to another Data Controller without impediments (so-called portability);
• obtain the updating, the limitation of the processing, the rectification of the Data and the cancellation of those processed in breach of current legislation;
• oppose the processing of personal data concerning his/her and the processing for the purpose of sending advertising material, direct sales and for carrying out market research;
• lodge a complaint with the Privacy Guarantor as the supervisory authority for the protection of personal data.

The interested party may exercise his/her rights by contacting the Data Controller by email at the address: legal@audaciainnovations.com

The User may request the deletion of their Celia account and associated data through the Celia app or by emailing legal@audaciainnovations.com. The request will be processed within 30 days, except from data that must be retained by law (such as billing information).

Third party websites or applications

The user acknowledges and accepts that by using the Website or the account it is possible to access certain contents or services provided by third parties. If so, a different privacy policy may apply.

The Data Controller is not responsible for the privacy policy of third parties, nor for compliance with it.

Changes to this Privacy Policy

The Data Controller reserves the right to make changes to this Privacy Policy at any time by giving notice to Users on this page.

Therefore, please consult this page often, referring to the date of the last modification indicated at the bottom.

In the event of non-acceptance of the changes made to this Privacy Policy, the User is required to cease using this Website and may request the Data Controller to remove their Personal Data.

Unless otherwise specified, the previous Privacy Policy will continue to apply to the Personal Data collected up to that time.

Privacy Policy updated in September 2026.