Privacy Notice
Version 2026-09-28.3. Last updated 28 September 2026.
Medley helps music booking agencies work with their email, artists, contacts and bookings. This notice explains how personal information is handled when you visit our website, use Medley, contact us, or appear in information processed through the service.
Medley does not make your agency's workspace content available to other customer organisations. You can still instruct Medley to send or share information with recipients you choose, including someone who separately uses Medley. Our shared business directory contains independently researched public information, not private customer communications or booking history. Authorised service providers and Medley personnel may process information confidentially for the purposes explained below.
1. Who is responsible
Medley Technologies OÜ, registry code 17468055, is established at Tornimäe tn 5, 10145 Tallinn, Estonia. Contact us about privacy or a request concerning personal information at hello@medley.fm.
We act as a controller when deciding how to handle information for our own account administration, business relationships, billing, security and legal compliance, and for our independently researched public business directory.
For an agency's connected emails, booking records, files and related service processing, we generally act as its processor under our Data Processing Agreement. The agency determines the purposes of its booking work and is responsible for its lawful instructions and its own privacy information. Where it acts for another controller, Medley may act as a subprocessor. Our role does not change merely because software or AI performs an operation.
If your information appears in an agency's mailbox or records, the agency's privacy notice also matters. You can contact that agency or ask us to help direct your request. We do not automatically give an administrator access to every user's private mailbox or chat simply because the administrator manages billing.
2. Information we handle and its sources
Account and business-contact information: name, business email, agency, role, authentication identifiers and account preferences
Where it comes from: You, your agency's administrator, invitations and the authentication service
Billing and agreement information: legal name, address, VAT/tax details, subscription, invoices, payment status and acceptance records
Where it comes from: You, the agency and payment/accounting services; card details are collected by the payment provider rather than entered into Medley's workspace
Workspace information: artists, contacts, companies, venues, bookings, dates, deal terms, availability, notes, uploaded files and imports
Where it comes from: Users and their authorised integrations/imports
Email information: messages, headers, correspondents, folders/labels, message state, drafts and attachments, plus connection identifiers and authorisation credentials
Where it comes from: Mailboxes users connect through our email integration service; ordinary email can contain information about people who do not have Medley accounts
AI and quality information: prompts, answers, suggestions, relevant source evidence, corrections, feedback and diagnostic records
Where it comes from: Use of AI features and related support or quality investigations
Technical information: IP address, device/browser information, access events, errors, timing, feature activity and security records
Where it comes from: Interaction with the website/service and its supporting systems
Support and enquiry information: contact details, messages and material deliberately shared for assistance
Where it comes from: You or another authorised person contacting us
Public business-directory information: business names, locations, websites, publicly listed professional contacts and supporting source references
Where it comes from: Public websites, official business sources and authorised research services; private workspace material is not a source for the facts published in the shared directory
Information needed to authenticate an account, provide a requested feature, take payment or comply with law is necessary for those purposes. If it is not supplied, we may be unable to create the account or provide the affected feature. Connecting a mailbox and supplying optional profile or feedback information are choices; email-dependent features need the corresponding connection.
3. Our purposes and legal bases
For processing where Medley is a controller, we use these bases under applicable EU or UK data-protection law:
Manage business accounts, invitations, agency relationships and ordinary service communications
Basis and relevant interest: Legitimate interests in providing and administering a secure B2B service. Contract necessity applies where the individual is personally a party to the contract, rather than automatically to every agency employee.
Process orders, payments and invoices; keep accounting and required agreement records
Basis and relevant interest: Contract necessity where applicable, legitimate interests in administering the agency contract, and legal obligations for tax/accounting records
Protect accounts and systems, prevent misuse, investigate incidents and handle legal claims
Basis and relevant interest: Legitimate interests in a reliable and secure service and protecting rights; legal obligations where a specific requirement applies
Answer enquiries and support requests
Basis and relevant interest: Legitimate interests in responding and supporting the service; steps requested before entering a contract where the individual will be the contracting party
Maintain the independently researched public business directory
Basis and relevant interest: Legitimate interests in helping booking professionals identify businesses and professional contacts, subject to relevance, accuracy, necessity and individuals' rights
Send optional product/news communications or use optional tracking where consent is required
Basis and relevant interest: Consent, which can be withdrawn. We do not treat accepting the subscription agreement as marketing consent. Necessary account, billing and security messages are separate.
We assess whether the legitimate interests relied on are proportionate and whether people's rights override them. You can ask about that assessment and object as explained below. We do not rely on these controller purposes as a general permission to read agency mailboxes or reuse private booking records for unrelated product development.
For agency content, the agency supplies the applicable lawful basis and instructions, and Medley processes it to deliver the agreed service. Correspondence may incidentally contain sensitive information, such as a health-related explanation for cancelling a performance. The agency must have the necessary additional legal condition where required; a business contract with Medley is not consent from the person concerned. The service is not offered for systematic sensitive-data profiling.
4. Email, AI and public-entity research
A connected mailbox allows the email functions the user authorises, including synchronisation, display, search, drafts and sending/actions, AI extraction and contextual assistance. Relevant messages, attachments and history may be stored to provide those functions and make suggested changes understandable. Features may use manual, assisted or automated workflows within the agency’s instructions and the user’s permissions. An authorised setting or instruction can enable a defined class of ongoing actions; a separate confirmation is not necessarily required for each action. The scope is explained when an automation is enabled. We do not use these features to make solely automated decisions producing legal or similarly significant effects about individuals.
AI providers receive the information needed for the requested operation under the applicable service arrangements. Customer content is not supplied to them for their own general-purpose model training by default. AI outputs can be wrong, so users should exercise appropriate oversight of consequential actions and their automation settings.
When a workflow refers to a company, venue or similar entity, Medley can use the necessary name and location or other disambiguation details to find and research the matching public business. Only independently researched public facts enter the shared directory. Customer emails, import rows, private notes, deal terms, relationship history and the identity or activity of the agency that triggered a lookup are not published to other organisations. Lookup inputs retained for operations or diagnosis remain protected.
Medley's use of information received from Google Workspace APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements, and the applicable Google Workspace user data policy. Source-specific restrictions continue to apply to covered derived information. A user's confirmation of a suggestion does not itself create unrestricted reuse rights.
5. Quality measurement and human review
We measure failures, latency, cost, feature use and acceptance/rejection/correction patterns to maintain and improve the service. These signals are not treated as proof that an AI result is right or wrong. Routine operational logs should not contain raw email bodies; content-bearing diagnostic traces have separate access and retention controls.
Authorised personnel may access and confidentially inspect content as necessary to provide, maintain, secure, troubleshoot, evaluate and improve the agreed service, including onboarding, support and quality assurance. Access remains within the agency’s instructions, applicable law and binding source/provider requirements. Where specific permission is required, we ask the user to share identified material or authorise a bounded investigation and record that permission. Other necessary service access does not require a separate approval for every operational query. Scope and any required permission may be recorded through support correspondence or another suitable process; no particular reporting interface is required. A thumbs-down alone does not open the whole conversation or mailbox to staff.
Review is restricted to named personnel, with confidentiality, privileged-access protection and access records. The same restrictions apply to an approved internal tool or database query. Concierge access to shared business records does not automatically grant private mailbox or chat access.
Eligible public, licensed, synthetic, customer-authorised or genuinely anonymous material may support evaluation and improvement where the intended use is lawful and source-permitted. Retaining real customer examples for reusable evaluations requires a separate eligibility decision, defined purpose, appropriate permission and retention. A support submission is not an indefinite training licence. Cross-agency market intelligence is not part of this early-access processing; a future feature would require its own assessment and any necessary notices or permissions.
6. Recipients and international processing
We use services for hosting, databases, file storage, authentication, email connectivity, AI, operational monitoring, public research, maps, payments, accounting and support. Our Subprocessors page describes the relevant service providers and their roles. Some providers act separately as controllers for their own payment, compliance or account-security functions; their privacy notices explain those activities.
Information is also available to authorised people within the agency according to the service's permissions, and to recipients when a user instructs Medley to send or share it. Professional advisers or authorities may receive information where necessary for a legal obligation, claim or authorised business transaction, subject to confidentiality and source restrictions. A business transfer does not dispense with any required user permission.
An EU storage region does not necessarily mean every support or ancillary processing activity occurs in the EU. The vendor information must be read for the relevant processing arrangements. Where a transfer outside the EEA or UK requires safeguards, we use an applicable adequacy decision or appropriate contractual safeguards, such as the relevant standard contractual clauses, with assessments and supplementary measures where required. Contact us for information or a copy of applicable safeguards, subject to protection of confidential material.
7. Retention
For the first early-access cohort, the service uses the following schedule. The agency may instruct earlier deletion, subject to limited lawful exceptions.
Saved workspace, including stored email/chat history, attachments and retained import originals
Period or rule: During active service, followed by a recoverable 12-month archive after paid access ends, unpaid suspension begins, or an unconverted trial expires. A failed first payment receives the agreed grace first. A completed switch has the shorter retrieval period in the agreement unless the agency expressly chooses the archive.
Disposable import conversion files and working copies
Period or rule: Up to 30 days after completion or abandonment; retained originals are workspace assets, not disposable copies
Raw AI diagnostic traces and routine operational logs
Period or rule: Up to 30 days
Minimised error and security records
Period or rule: Up to 90 days
Material shared for an authorised quality/support investigation
Period or rule: Up to 90 days after closure; open cases reviewed at least every 90 days
Records of staff access to private content
Period or rule: 12 months
Content-free, non-identifying aggregate quality metrics
Period or rule: 12 months, subject to source restrictions
Separately eligible evaluation datasets
Period or rule: The defined, recorded period for that purpose, not an indefinite default
Accounting records and documents necessary to evidence transactions
Period or rule: The statutory period, generally seven years from the relevant financial year end; longer where a specific legal rule for continuing rights/obligations requires it
Other account, enquiry, contact and agreement records
Period or rule: While needed for the relationship, request or a documented legal obligation/claim; we minimise retained records and do not keep the whole workspace merely to prove a contract
Independently sourced public professional-directory information
Period or rule: While relevant and accurate for the directory's purpose, with correction/removal when obsolete or otherwise required
The recoverable workspace covers content actually stored by Medley. Attachment bytes fetched only from the email provider are not preserved merely because a message includes an attachment reference; their availability depends on the source and any necessary reconnection. Medley does not back up the entire external mailbox.
After archive/retrieval expiry or an authorised deletion instruction, affected live-system data is deleted without undue delay and within 30 days; isolated backup copies expire within another 30 days. If a backup is restored, outstanding deletion instructions must be reapplied before ordinary processing resumes. A stricter mandatory requirement takes precedence.
Narrow extensions for an ongoing authorised investigation require a recorded reason, limited material and periodic review; they do not override an agency’s deletion instruction. After instructed processing ends and the applicable return/deletion process, processor-held content may remain only where EU or Member State law requires storage. Minimum records Medley lawfully holds as a controller, such as billing and agreement records, may have a separate legal retention requirement or a necessary, documented claims purpose. That does not permit keeping an agency’s workspace or relabelling its content as our own records.
Disconnecting a mailbox stops new provider access, sync and sending through that connection and revokes connection credentials controlled by Medley. Saved copies remain under the retention policy and may support user-requested features where the agency’s instructions, permissions and source rules allow; disconnection is not deletion. Pending work must respect revoked access and any processing restriction or deletion instruction. Archive stops ordinary active-service sync, AI processing and scheduled sending and revokes active mailbox credentials. Necessary security, storage/retention, billing and customer-requested recovery or exit handling may continue. A returning user may need to reconnect. Deleting Medley's copies does not delete original messages from the email provider.
8. Cookies and similar storage
Medley uses cookies and similar storage for sign-in, request security and interface preferences. The application uses medley_session for authentication, medley_auth_state for a short sign-in security check, and medley_csrf for request protection. The sign-in state cookie lasts up to ten minutes; the application session and request-protection cookies are session cookies, with access also governed by the authentication session. The sidebar_state preference cookie records whether the sidebar is open and lasts up to seven days. Browser storage may retain other interface choices until changed or cleared.
Authentication, payment, support and website services may use their own cookies or similar technologies. Where consent is required for optional analytics, marketing or other non-essential storage, we request it before use and provide a way to change your choice. Rejecting optional tracking does not withdraw the subscription agreement.
9. Your rights and choices
Depending on the applicable law and processing, you may request access, correction, erasure, restriction or a portable copy of your personal information. You may object to processing based on legitimate interests and to direct marketing. Where processing relies on consent, you may withdraw it without affecting the lawfulness of earlier processing. Some rights are subject to legal conditions and the rights of other people.
Email hello@medley.fm. We may need proportionate information to verify identity and scope. Where we act as a processor, we assist the responsible agency rather than deciding its purposes or deleting an entire agency workspace on an unauthorised request. We respond within applicable legal deadlines, normally one month, and explain any permitted extension or refusal.
You can complain to the supervisory authority where you live or work or where an alleged infringement occurred. Medley's Estonian authority is the Data Protection Inspectorate (Andmekaitse Inspektsioon); in the UK you can contact the ICO. Contacting us first can help resolve a concern but is not a condition of exercising your rights.
10. Updates
We keep this notice available and identify its version. Material changes will be brought to affected users' attention as appropriate, with additional permission where required. Updating a privacy notice does not itself amend an accepted agreement or authorise a new use of private content.