Effective date: 16 September 2026.
1. Who is responsible
The 111 Foundation operates 111 at 111bpm.com and is responsible for the personal information described in this policy. Where the GDPR applies, it acts as the controller. This policy covers the website, accounts, submissions, forum, support, and related operation of the service.
Contact the Foundation about privacy or any other concern at legal@111bpm.com, or write to The 111 Foundation, 4335 Van Nuys Blvd, Suite 232, Sherman Oaks, California 91403, United States. You do not need an account to make a privacy request. Where legally required, we provide the contact details of our appointed representative.
2. Information we collect
- Account and access information: contact email, private account name, account identifiers, invitation and membership records, authorized capabilities, authentication and security records, and assignments allowing an account to act for an artist identity. Authentication providers process credentials and multifactor-authentication information.
- Adult eligibility and agreements: your declaration that you are at least 18, its date, the terms version you accept, and records of artist-permission choices and authorized uses. The declaration does not require your birth date or an identity-document copy and is not independent age verification.
- Artist and publication information: artist names, optional profile fields, biographies, links, avatars, music and images, writing, credits, source and rights declarations, drafts, revisions, editorial feedback, and publication decisions. We receive this from you and, where authorized, other controllers, contributors, or editors.
- Private community activity: forum posts and replies, account-private writing drafts, reading progress, bookmarks, followed discussions, and moderation reports. Search is performed against the permitted content; the application does not keep a personal forum-search history.
- Requests and safety information: messages you send us, reports made by others, evidence needed to assess them, identity checks proportionate to a request, decisions, and records of our response. A report may contain information about someone other than its sender.
- Technical information: IP addresses, request times, browser/device information, security events, delivery errors, and similar information processed by us or our infrastructure providers. For playback abuse prevention, the application derives a daily-changing keyed identifier from an IP address instead of storing the raw address in its playback-rate records. Infrastructure access logs are separate and may contain IP addresses. This identifier is not treated as anonymous data merely because it is hashed.
We obtain information directly through your use of the service, from authorized collaborators and invitation senders, from people making reports, and from providers operating the service. Required fields are identified in the relevant workflow. If you decline information necessary to activate or secure an account, submit a work, or verify a request, we may be unable to complete that action. Optional public profile fields can be left blank.
3. Public work and private account information
Published artist profiles, approved credits, non-explicit published work, and public journal material are visible to visitors and may be indexed, copied, or linked by others. Explicit work is restricted to eligible adult accounts. Content included in an authorized external compilation or promotion may also be distributed outside the website under the Terms of Use.
Private account names, emails, authentication identifiers, controller assignments, invitation details, and private drafts are not public artist-profile information. We restrict them to authorized people and providers with a service, security, editorial, or legal reason to access them. An approved artist name may be a chosen name or persona; it does not disclose the real account behind it. People jointly controlling an artist identity can access that identity's shared workspace, but not another controller's account-private forum drafts or reading preferences.
The forum is available to authorized members, rather than the public. Other members can nevertheless copy what they can read. Do not post information you need to keep confidential or disclose another person's sensitive information without a lawful basis. Artwork or text can itself reveal sensitive personal information; we do not use such content to infer advertising interests or build sensitive advertising profiles.
4. Why we use information
We use information to operate accounts and approved membership; provide and secure the website; store, review, publish, and deliver work; provide forum features; carry out your permission choices; attribute contributions; respond to requests; moderate abuse; maintain backups and recover safely; and meet legal obligations.
Where the GDPR applies, our bases are performance of the agreement for the service you request, legitimate interests in security, abuse prevention, reliable operation and appropriate records, compliance with legal obligations, and consent where required for an optional activity. We assess legitimate interests against people's rights and reasonable expectations. We do not treat agreement to the terms as consent for every use of information. If special-category information requires an additional legal condition, we establish that condition before the relevant processing; publishing art is not blanket permission for unrelated sensitive-data use.
Where Canadian law requires consent, we seek meaningful consent appropriate to the purpose and sensitivity, subject to lawful exceptions. You may withdraw consent where it is the relevant basis, without affecting the lawfulness of earlier processing. We explain any effect on the requested service. Withdrawing a copyright permission and exercising personal-information rights are different requests; neither removes rights you have under applicable privacy law.
We do not sell personal information, share it for cross-context behavioral advertising, or use targeted advertising. We do not use uploaded work to train AI models. We do not make solely automated decisions producing legal or similarly significant effects on you; editorial and moderation decisions have human review.
5. Cookies and browser storage
We use authentication/session cookies necessary to sign you in and keep the service secure. The player uses browser storage to remember your listening queue. These features support the service you request. Clearing browser storage may sign you out or clear local preferences; it does not delete server records or close an account.
The service does not use advertising cookies, marketing pixels, or optional audience-analytics trackers. If that changes, we will update the disclosures and obtain consent where required before activating non-essential tracking. We do not conduct cross-site advertising tracking, regardless of a browser's Do Not Track setting. Global Privacy Control or other legally recognized opt-out signals will be honored where applicable; the absence of a signal does not authorize sale or advertising sharing.
6. Who receives information
We disclose information to the audiences you choose through publication or permitted community participation, and to authorized controllers, editors, moderators, or administrators according to their responsibilities. Service providers process information for hosting, authentication, databases, media storage and delivery, email, security, and backups under appropriate contracts and access restrictions.
We may disclose information when legally required, to respond to a valid legal process, to protect people or rights, or to investigate abuse where lawful and proportionate. A complaint or counter-notice may need to be shared with an affected person or authority; we limit disclosure to what the process requires and protect confidential reporting information where possible. Professional advisers may receive information subject to confidentiality obligations. We do not give providers a general permission to sell member information or use contributions for their independent purposes.
7. International processing
The Foundation is in the United States. Providers may process information in the United States and other countries where they operate, with different privacy laws. We remain responsible for appropriate provider arrangements. Where a transfer is legally restricted, we use an applicable transfer mechanism, such as a valid adequacy decision or appropriate contractual safeguards, and any required supplementary protections. We do not rely on acceptance of this policy as blanket consent to international transfers.
Contact us to learn the processing locations and transfer safeguards relevant to your information or to request an available copy of those safeguards.
8. How long information remains
We keep information for the purposes described here, rather than treating all information as permanently needed. The category, reference to a shared work, an unresolved report, legal obligations, and recovery needs affect the period.
- Active accounts and retained work: account information remains while needed for the account. Referenced drafts, revisions, published work, and associated media remain while retained. Unpublishing alone does not delete all stored revisions or media.
- Account closure: the closure process acknowledges a request and sets a completion target of seven calendar days. We remove access, ordinary private account information, and material selected for deletion through a reviewed process. Provider failures or a necessary review can delay completion; we keep the request status available and do not treat a target date as proof of deletion. Applicable statutory deadlines still apply.
- Sole and shared artist identities: work controlled solely by the departing account is withdrawn by default unless specific published work is deliberately retained. Shared artist identities and their work remain with other authorized controllers; the departing account's assignments are removed. Specific shared-work removal and attribution requests receive separate review.
- Credits and discussions: approved credits on other works may remain as name/contribution snapshots without an account link. Retained personal forum contributions display “Former member”; shared-persona posts retain the artist identity. Removing an author link does not erase identifying information within the text. You can request review of particular content or credits under your privacy rights.
- Moderation evidence: necessary evidence remains for an open case. Closed reports and associated private evidence become eligible for purge 90 days after resolution, unless another active case or a lawful preservation requirement needs them. This does not automatically delete current discussion text.
- Recovery copies: authorized media deletion begins a 30-day recovery period. Independent database snapshots normally retain 30 days of history, but the newest usable snapshot may be preserved longer during an outage. Restored data is subject to the deletion record before service resumes; backups are not a permission to restore deleted accounts or republish withdrawn work.
- Minimal recovery and accountability records: restricted identifiers and actions may remain to prevent deleted information from returning after restoration and to document agreements, earlier authorized releases, or necessary legal obligations. The deletion ledger currently has no fixed expiry while it remains necessary for safe recovery. It excludes purged content bodies and contact details but is not assumed to be anonymous. We review continued necessity and applicable rights.
- Operational logs and request records: we retain these only for as long as needed for security, delivery, complaint handling, and legal accountability. We determine retention periods from the purpose of each record, the time needed to resolve a request or incident, and applicable legal obligations. Legal preservation may extend an otherwise applicable period, with access restricted to that purpose.
Closing an account or opting out of new promotional use does not automatically recall an earlier authorized release. A valid privacy, safety, or infringement request is assessed separately and can require action despite a retained copyright permission.
9. Your choices and rights
Use account controls where available or contact legal@111bpm.com or the postal address above. Tell us what you need and enough information to locate the relevant account or material. We verify identity and authority proportionately before disclosing or changing private information; an artist name alone does not prove control of an account. An authorized agent may act where permitted, with appropriate proof of authority. You can contact us without signing in, including after closure.
Depending on the law that applies, you may request access to your information and information about its use; a copy or portable export; correction; deletion; restriction; objection to particular processing; withdrawal of consent; or review/appeal of a refused request. We explain any lawful exception and available complaint route. Requests must not expose another person's private account or controller mapping. We do not retaliate or unlawfully discriminate for exercising rights, and ordinarily do not charge for a request.
European Union / EEA: where the GDPR applies, you have its applicable rights of access, rectification, erasure, restriction, portability and objection, including objection to processing based on legitimate interests, and withdrawal of consent. You may complain to the supervisory authority where you live or work or where a suspected infringement occurred. We respond without undue delay, ordinarily within one month; if a permitted extension is necessary, we notify you within that month and explain it.
Canada: where applicable federal or provincial privacy law applies, you can seek access, challenge accuracy, withdraw consent subject to lawful limitations, and complain to our privacy contact or the appropriate federal or provincial commissioner. Applicable PIPEDA access requests are normally answered within 30 days; legally permitted extensions are explained within the original period. Provincial rules may differ.
California and other US states: where applicable state law grants them, rights may include knowing/accessing collected information and disclosures, correction, deletion, portability, limits on certain sensitive-information uses, opting out of sale, targeted advertising or certain profiling, and appeal. We do not sell or share information for cross-context behavioral advertising. Covered CCPA requests are normally answered within 45 days, with a permitted extension explained when needed. Other state deadlines and complaint or appeal rights remain applicable. You may contact the relevant state privacy regulator or attorney general. The Foundation's name alone does not establish an exemption or that any particular state law applies.
We accept privacy concerns from everyone even when a particular statute does not apply. These descriptions do not reduce any more protective mandatory right or shorter applicable deadline.
10. Children and security
Accounts are for people aged 18 or older. We do not knowingly permit under-18 accounts or give known minors access to explicit content. Contact us if you believe a child has an account or has supplied personal information. We restrict access and assess deletion and any required protective steps. Non-explicit public browsing does not create an account; necessary technical requests may still reach the hosting infrastructure.
We use proportionate access controls, private media storage, protected connections, backups, and required multifactor authentication for privileged actions. No service can guarantee complete security. We assess incidents and notify affected people and authorities when legally required. Do not send credentials or sensitive identity documents through an ordinary support message.
11. Changes
We publish a dated version of this policy and give appropriate notice of material changes. If a new purpose requires consent, we obtain it before that use. An update does not retroactively authorize a new use of your information or waive an existing right. The effective date above identifies the current version.