Northeast Noise Company (“Nenco”, “we”, “our”) operates nenoise.com and the Nenco music distribution platform. We respect your privacy and process personal data only as necessary to deliver the service. This policy explains what we collect, why, who we share it with, and the rights you have under India's Digital Personal Data Protection Act 2023 (DPDP Act), the Information Technology Act 2000, and applicable global standards (GDPR for EEA/UK users, where relevant).
1. Who we are
Nenco is a brand operated by Northeast Noise Company, a sole proprietorship based in Guwahati, Assam, India. Northeast Noise Company is the data fiduciary for the personal data described in this policy: we decide why and how it is processed. For privacy questions, write to hello@nenoise.com. Our Grievance Officer's details are in section 11 below and on the grievance redressal page.
2. What we collect
- Account data: email address, display name, and the consent flags you set during signup.
- Profile data: artist names, label names, biographical text, profile imagery, and roster relationships you set up inside the dashboard.
- Content data: audio files, cover art, lyrics, metadata, and collaborator split percentages you upload for distribution.
- KYC data (for payouts only): PAN number, Aadhaar number, bank account / UPI details, and identity verification images. KYC data is encrypted at column level in our database (Fernet symmetric encryption); images are never stored in public buckets.
- Royalty data: stream counts, earnings, territory breakdowns, and payout history sourced from streaming platforms.
- Operational data: server logs, IP addresses, device identifiers, and interaction events used for fraud prevention and service reliability.
- Contact form: when you use the form on our home page we receive your name, email address, the artist or label name if you give one, and your message. It is delivered to our inbox as an email (sent through Google Workspace) so we can reply to you; it does not create an account.
- Communications: emails you send us, newsletter sign-ups, and support conversations.
3. Why we use it
- To deliver your music to streaming platforms and report royalties back to you.
- To compute and disburse collaborator royalty splits.
- To verify your identity before disbursing payments (statutory KYC requirement).
- To prevent fraud, copyright infringement, and abuse of the platform.
- To send transactional emails (magic-link sign-ins, release notifications, payout receipts).
- To reply to messages you send us through the contact form or by email.
- To send marketing or newsletter emails only when you have opted in.
- To comply with legal obligations (tax reporting, takedown notices, law-enforcement requests).
We process personal data on the basis of the consent you give when you sign up, contact us or upload a release, or for the legitimate uses the DPDP Act permits without separate consent (for example, data you provide voluntarily for a stated purpose, and processing we must do to comply with law). We use data only for the purposes listed above.
4. Who we share with
- Streaming platforms (DSPs): Spotify, Apple Music, JioSaavn, YouTube Music, Amazon Music, and 145+ others receive your release metadata and audio files for the purpose of making your music available.
- Payout partner: Easebuzz checks bank accounts and sends payouts. It receives the payee's name and bank account details for that, and handles them under its own privacy policy.
- Distribution backend: we work with a third-party distribution provider that handles physical delivery of releases to DSPs. They receive only the data needed for that purpose.
- Service providers (data processors): Vercel (hosting for the nenoise.com website), Google Workspace (our email: it sends sign-in links, invites and contact-form messages, and holds our inbox), Resend (backup email delivery, used only if Google is unavailable), Cloudflare R2 (storage for audio, artwork and other uploaded files), and Cloudflare (DDoS protection for our API, and cookie-free visit statistics through Cloudflare Web Analytics). Our backend application and database run on a server we operate ourselves in India. Processors act on our instructions and only for the purposes above.
- Legal authorities: when compelled by a valid court order, government authority, or to defend our legal rights.
Some of these providers process data outside India. The DPDP Act allows this except to countries the Government of India has restricted, and we will stop any transfer that becomes restricted.
We do not sell your personal data, do not run advertising targeting on nenoise.com, and do not share royalty figures with third parties beyond what is required to process your payouts.
5. Data retention
Account and content data is retained for the lifetime of your account plus 7 years for statutory tax and royalty audit purposes. KYC data is retained for 5 years after the last transaction (per RBI guidelines). Logs are retained for 90 days. Contact-form messages and other emails are kept as correspondence for as long as we need them to deal with your enquiry and any follow-up. You can request earlier deletion subject to legal hold obligations — see “your rights” below.
6. Your rights
Under the DPDP Act (and applicable global laws), you have the right to:
- Access the personal data we hold about you.
- Correct data that is inaccurate or incomplete.
- Erase data we no longer have a lawful basis to retain.
- Nominate a person to exercise these rights on your behalf in case of incapacity or death (DPDP §14).
- Withdraw consent to any processing that relies on it (this may limit your ability to use parts of the service).
- Lodge a grievance with our Grievance Officer (and ultimately with the Data Protection Board of India). See grievance redressal.
To exercise any of these rights, email hello@nenoise.com with the subject line “data request” and the account email you signed up with. We'll respond within 30 days.
7. Security
We use TLS for all data in transit. KYC fields (PAN, Aadhaar, bank details) are encrypted at column level inside our database. Passwords are never stored — we use magic-link authentication. Audio uploads and cover art live in access-controlled object storage with signed URLs. No system is bulletproof; if we discover a breach affecting your data, we will notify you and the Data Protection Board within 72 hours.
8. Children
Nenco is not directed at children under 18. We do not knowingly collect data from minors. If you believe a minor has provided us personal data, email hello@nenoise.com and we will delete the account.
9. Cookies
We use only cookies that are strictly necessary for the service to work, and no analytics, advertising or third-party tracking cookies. We do not use Google Analytics, Facebook Pixel, or similar trackers. We count page visits with Cloudflare Web Analytics, which sets no cookies and does not follow you across other websites.
- Public pages (the home page and these policy pages) set no cookies of their own.
- Signing in to the dashboard sets one session cookie,
nenco-session, that keeps you signed in. It is HTTP-only (scripts on the page cannot read it) and lasts up to 30 days, or until you sign out. - Nenco staff using support tools may receive one further short-lived session cookie. It is never set for artists or labels.
- The dashboard remembers your light or dark theme in your browser's local storage, not in a cookie. It never leaves your device.
Because these cookies are needed to provide a service you asked for, we do not show a cookie consent banner. If we ever add cookies that are not strictly necessary, we will ask first and update this section.
10. Changes to this policy
Nenco reserves the right to update this policy at any time, at its sole discretion, as the service evolves or regulations change. Material changes will be announced via email to your account address at least 14 days before they take effect. Non-material changes (typos, clarifications, contact details) may take effect immediately on publication. The “last updated” date at the top of this page is authoritative.
11. Grievance Officer
Under the Information Technology Act 2000, the IT (Intermediary Guidelines and Digital Media Ethics Code) Rules 2021, and the DPDP Act 2023, you can raise a complaint about how we handle your personal data or about content on Nenco with our Grievance Officer:
- Name
- Darshan Saikia
- darshan@nenoise.com (subject line “grievance”)
- Phone
- +91 70865 98545
We acknowledge a grievance within 24 hours and resolve it within 15 days of receiving it. The full process, including how to escalate, is on the grievance redressal page.
12. Contact
- Data fiduciary
- Northeast Noise Company
- Based in
- Guwahati, Assam, India
- Registered office
- 16 Arunoday Path, Hengrabari, Guwahati 781036, Assam, India
- hello@nenoise.com
- Phone
- +91 70865 98545
More ways to reach us are on the contact page.