Epidemic Sound

GDPR overview

GDPR implementation is concrete and documented. Epidemic Sound AB is established in Sweden, so the GDPR applies directly and no Article 27 representative is needed. A Data Protection Officer has been appointed and is reachable at dpo@epidemicsound.com. The privacy notice spells out the full set of rights: access, rectification, erasure, restriction, objection, portability, withdrawal of consent and complaint to a supervisory authority. It names the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten) as the competent regulator. Rights are exercised through the support webform or by post. Transfers outside the EEA, to the USA and South Korea, rely on specific safeguards, standard contractual clauses being the most common. A Data Processing Addendum is published, aligned with the GDPR, the UK GDPR and the CCPA, listing subprocessors in Annex 1, with 30 days notice before any new one and a 14-day objection window.

Who owns the data?

Epidemic Sound AB (reg. no. 556781-0899, Västgötagatan 2, 118 27 Stockholm, Sweden) acts as data controller for account data, and has appointed a Data Protection Officer reachable at dpo@epidemicsound.com or by post marked Attn: DPO at the same address. Content ownership is split: you keep your intellectual property rights in the User Input you submit to Adapt, while Epidemic Sound owns the Licensed Works and the Adapted Licensed Works. The company states it owns 100% of the rights to its catalog, which is what makes the direct license possible. One exception: with the User Voice Model in Voices, you act as data controller and the Data Processing Addendum applies.

Reuse rights

Epidemic Sound collects account data (email, password, connected media channels, payment methods, name, age, company, address, country), technical data (IP address, device ID, operating system, browser, plugin path), transaction history and cookie data. It uses them to deliver the service, take payment, curate music, run personalized marketing and profiling, prevent fraud and meet legal obligations, relying on performance of the contract, legitimate interest and consent, the latter being withdrawable by writing to hello@epidemicsound.com. Data may be shared with other users of the same workspace, with public authorities, with an acquirer in a merger or sale, and with third-party services and connected APIs. Where an MCP or third-party LLM connection is used, account data may be transmitted and modified according to the requests made through that third party. On the AI side, User Input submitted to Adapt is used to train and improve Adapt, with an opt-out that enterprise customers may be able to exercise where Epidemic Sound makes such a feature available; the enterprise AI addendum states that User Input will not be used for training purposes other than as necessary to improve and personalize the results for the customer. In the other direction, the terms rule out any text and data mining of the catalog, so subscribers cannot reuse the content to train models of their own.

Data retention & training

Hosting summary

No hosting country is named as such in the privacy notice. What is declared is the transfer of personal data to group companies inside the EU/EEA and outside it, specifically the USA and South Korea, under specific safeguards, standard contractual clauses being the most common mechanism. The subprocessor list in Annex 1 of the Data Processing Addendum gives a sharper picture: Epidemic Sound subsidiaries in the EU/EEA, the United States, the United Kingdom and South Korea, Google Ireland LLC in the EU/EEA, Cartesia AI Inc. in the United States and Fastly Inc. in the United States. Delivery infrastructure runs on Fastly, on an anycast address resolving to 151.101.1.91. Jurisdiction is therefore Swedish and European for the controller, with a real operational footprint in the United States and South Korea. Buyers with strict data residency requirements should read Annex 1 before signing, bearing in mind that subprocessor changes are notified 30 days in advance with a 14-day objection window.