Version: 0.2.0 (draft) · Effective: upon publication
This Privacy Policy explains how Sazalem processes personal data when you visit `sazalem.kz`, `sazalem.com`, `admin.sazalem.com`, the Sazalem Android application, the Sazalem iOS application or any other service we operate (together, the "Service").
"Sazalem" (also "we", "our", "us") means jointly: SerikB LLC, a limited liability company organized under the laws of the State of California, United States of America (the "Licensor"), the data controller for users ordinarily resident outside the Republic of Kazakhstan; and Sazalem LLP (ТОО «Сазалем»), a limited-liability partnership organized under the laws of the Republic of Kazakhstan (the "Local Operator"), the data controller for users ordinarily resident in the Republic of Kazakhstan and responsible for compliance with the Republic of Kazakhstan Law "On Personal Data and Their Protection" № 94-V dated 21 May 2013 (the "PDP Law") for those users. The two entities act as joint controllers where they jointly determine the means and purposes of processing (for example, platform-wide fraud and abuse prevention).
We process personal data in accordance with the Republic of Kazakhstan Law "On Personal Data and Their Protection" № 94-V dated 21 May 2013 (the "PDP Law") and other applicable Kazakhstan legislation. Where we process the data of users located outside Kazakhstan, we apply the PDP Law as our base standard and supplement it as required by the local law of the user's residence.
1.1. The data controllers are:
- For users ordinarily resident in the Republic of Kazakhstan: Sazalem LLP (ТОО «Сазалем»), Republic of Kazakhstan (the "Local Operator"). The Local Operator is the controller responsible for compliance with the PDP Law in respect of those users. - For users ordinarily resident outside the Republic of Kazakhstan: SerikB LLC, State of California, United States of America (the "Licensor"). - The Local Operator and the Licensor act as joint controllers where they jointly determine the means and purposes of processing (for example, platform-wide fraud and abuse prevention). Where joint controllership applies, the Local Operator is the principal point of contact for KZ-resident users and the Licensor is the principal point of contact for all other users.
1.2. For any privacy question, request to exercise your rights under §7 below or complaint, contact:
- Email: privacy@sazalem.com - Postal (Local Operator, KZ-resident users): Sazalem LLP / ТОО «Сазалем», Republic of Kazakhstan - Postal (Licensor, non-KZ-resident users): SerikB LLC, State of California, United States of America - Designated privacy contact: Privacy Officer, privacy@sazalem.com
| Category | Examples | Source | |----------|----------|--------| | Account data | Display name, email address, phone number, password hash, locale, profile photo | You | | Authentication data | OTP codes, refresh-token identifiers, session identifiers, social-login identifiers (Google, Apple) | You / identity provider | | Creator data (Applicants and Artists) | Stage name, real name, country of residence, biography, links to other platforms, royalty splits, payout details | You | | KYC data (creators only) | Government-issued identity document (passport / national ID / driver's license), proof-of-rights documents | You | | Content data | Tracks, lyrics, cover art, descriptions, comments | You | | Usage data | Listening history, likes, follows, playlist activity, downloads, in-app navigation | Generated by your use | | Payment data | Subscription status, plan, payment-method tokens (we never see full card numbers), carrier-billing identifiers, transaction logs, payout transaction logs | You / payment processor / mobile carrier | | Technical data | IP address, device model, OS version, app version, language, time-zone, crash logs, push-notification token | Your device | | Communications | Support tickets, chatbot transcripts, feedback submissions, takedown notices | You | | Legal-acceptance proofs | Hash of the legal-document version accepted, IP, user-agent, timestamp | Generated when you accept a legal document |
3.1. We do not deliberately collect special-category personal data (racial or ethnic origin, political opinions, religious beliefs, trade-union membership, genetic or biometric data, health, or data concerning sexual life or sexual orientation).
3.2. KYC documents may incidentally reveal date of birth, place of birth, citizenship or other special-category data; we treat such data under heightened security and use it only for identity verification and anti-fraud purposes.
| Purpose | Examples | Legal basis (PDP Law) | |---------|----------|----------------------| | Provide the Service | Account creation, content delivery, search, recommendations | Performance of contract (TOS) | | Authenticate you | Login, OTP, refresh tokens | Performance of contract | | Process payments and payouts | Charge subscription, distribute royalties via Abyroy | Performance of contract; legal obligation (tax) | | Moderate content | Process applications, releases, takedowns; run automated checks | Legitimate interest in lawful Service; legal obligation | | KYC and anti-fraud | Verify creator identity; detect fake streams, sanctions screening | Legal obligation; legitimate interest | | Communicate | Service announcements, payout statements | Performance of contract | | Marketing emails | Newsletters, product news | Consent (you can withdraw at any time) | | Personalization | Recommendations, "made for you" playlists | Legitimate interest; consent where required | | Analytics and product improvement | Aggregated usage stats, A/B tests | Legitimate interest | | Security | Detect intrusions, abuse, account takeover | Legitimate interest; legal obligation | | Legal compliance | Respond to lawful requests, retain records | Legal obligation |
5.1. Service providers. We share personal data with the following categories of processors who act under written instructions and appropriate confidentiality and security commitments:
| Processor | Function | Data location | |-----------|----------|--------------| | Cloudflare, Inc. | CDN, edge cache, bot protection, R2 object storage (audio, images, KYC documents) | Global edge; KYC bucket pinned to Western Europe | | Anthropic PBC | LLM API for the in-app chatbot and admin tooling | United States | | SendGrid (Twilio) | Transactional email | United States | | Firebase / Google LLC | Push notifications, crash reporting, analytics for mobile apps | United States / EU | | Apple Inc. | iOS push notifications, App Store payments | Global | | Mobile carriers (Tele2 KZ, Beeline KZ, Kcell, Activ) | Carrier billing, subscription management | Republic of Kazakhstan | | Kazakh banks and payment processors | Card payments | Republic of Kazakhstan | | RSO «Абырой» | Royalty collection, distribution and reporting | Republic of Kazakhstan | | BetterUptime | Uptime monitoring | EU | | Self-hosted PostgreSQL on PS.KZ | Primary database | Republic of Kazakhstan |
5.2. Other recipients. - Other Sazalem users — your public profile information, your public content and your public engagement (likes, follows, public comments) are visible to other users. - Rights-holders and Abyroy — for royalty calculation and distribution, we share aggregated and per-track listening data that is necessary to compute splits and payouts. - Law-enforcement and regulators — where required by a binding legal request from a competent Kazakh authority, or where a foreign request is recognized under Kazakh law. - Successors — in the event of a merger, acquisition or sale of substantially all of our assets, personal data may be transferred to the successor; the successor will be bound by this Privacy Policy or a substantially equivalent one.
5.3. We do not sell personal data, and we do not share personal data with advertising networks for cross-context behavioral advertising.
6.1. Some processors listed in §5.1 are located outside the Republic of Kazakhstan. Where personal data is transferred to a foreign jurisdiction, we transfer it under contractual safeguards (processor agreements that include confidentiality, security and sub-processing controls equivalent in substance to PDP Law requirements).
6.2. KYC documents are stored in a private Cloudflare R2 bucket pinned to the Western Europe region; access requires a server-issued short-lived signed URL.
7.1. Subject to the PDP Law and other applicable law, you have the following rights with respect to your personal data:
(a) Access — to obtain confirmation of whether we process your data and a copy of that data; (b) Rectification — to have inaccurate or incomplete data corrected; (c) Erasure — to have your data deleted, subject to retention requirements in §8 and the business-record retention rules in §9 of the Terms of Service; (d) Restriction — to ask us to limit certain processing; (e) Portability — to receive your data in a structured, machine- readable format; (f) Objection — to object to processing based on legitimate interest; (g) Withdraw consent — where processing is based on consent, to withdraw that consent at any time; (h) Complaint — to lodge a complaint with the Personal Data Protection Committee of the Republic of Kazakhstan.
7.2. To exercise any of these rights, write to privacy@sazalem.com from the email address associated with your account, or use the in-app "Privacy" controls. We respond within thirty (30) days. We may ask you to verify your identity proportionately to the sensitivity of the request.
7.3. We do not charge a fee for exercising your rights, save where the request is manifestly unfounded or excessive (in which case we will explain the basis for any fee and you may decline).
We keep personal data only as long as necessary for the purpose for which it was collected and to comply with applicable law:
| Data | Retention | |------|-----------| | Active account data | While the account is active, plus 30 days after closure for restoration | | Authentication tokens | Per session lifetime (refresh token: 30 days sliding) | | Listen logs (linked to user) | 24 months, then aggregated and de-identified | | Listen logs (aggregated) | Retained indefinitely as anonymous statistics | | Payment and payout transaction logs | 7 years (tax law) | | KYC documents | Until the latest of (a) account closure + 12 months, (b) 5 years from collection, or (c) the period required by anti-money-laundering law | | Takedown notices and counter-notices | 7 years | | Legal-acceptance proofs | Indefinite (immutable audit) | | Support tickets | 5 years | | Chatbot transcripts | 24 months for the originating user; cost-aggregate data indefinite | | Crash logs | 90 days | | Backups | Up to 180 days (encrypted at rest) |
After the applicable period, data is deleted or irreversibly de-identified.
9.1. The Service is not directed to children under the age of 13.
9.2. Users between 13 and 18 may use the Service only with the informed consent of a parent or legal guardian. We may at any time ask for proof of consent and may disable accounts where consent is not produced.
9.3. If we learn that we have inadvertently collected personal data of a child under 13, we will delete that data without undue delay.
10.1. The Sazalem website uses a small number of strictly necessary cookies (session, language preference, CSRF protection) and, with your consent, analytics and preference cookies.
10.2. You can manage your cookie preferences in the cookie banner or in your browser settings. Strictly necessary cookies cannot be disabled because they are required to deliver the Service you have requested.
11.1. We apply technical and organizational measures appropriate to the risk, including encryption in transit (TLS 1.2+), encryption at rest for KYC documents and payment-related data, role-based access controls, audit logging, secret rotation, two-factor authentication for administrators, segregated production access via SSH bastion, and immutable audit logs for legal acceptances and KYC.
11.2. No security measure is perfect. We will notify the affected users and the competent regulator of a personal-data breach without undue delay where required by the PDP Law.
12.1. We use automated checks to scan submitted releases for audio quality, fingerprint duplication, AI generation, impersonation and explicit imagery. A human reviewer makes the final decision on every release; you can also request human review at any time at appeals@sazalem.com.
12.2. We use automated checks to detect fake streams and account- takeover patterns. A human reviewer makes the final decision on any royalty claw-back, account suspension or account disabling that results from such detection, except in cases of clear, large-scale, coordinated fraud where immediate suspension is necessary to protect the catalogue.
We will notify you of material changes at least fourteen (14) days before they take effect, by in-app notice and (for users with an email address on file) by email. Continued use of the Service after the effective date constitutes acceptance of the revised Policy.
If there is any conflict between this Privacy Policy and a more specific notice we present at the point of data collection, the more specific notice prevails for that processing activity.
Contact: privacy@sazalem.com · SerikB LLC (California, USA, Licensor) · Sazalem LLP / ТОО «Сазалем» (Kazakhstan, Local Operator)