Privacy Policy

1. Data Controller

The data controller responsible for your personal data is Sound To Sounds ("we", "us", "Platform"). For data protection enquiries, contact us at [email protected].

2. Data We Collect

Data	Purpose	Legal basis
Email address	Account creation, login, transactional emails	Contract
Username / display name	Profile display on the Platform	Contract
Password (hashed)	Account authentication	Contract
Payment data (processed by Stripe)	Subscription billing and pack purchases	Contract
Purchase history	Granting access to purchased samples	Contract
Uploaded audio files and cover images	Publishing your content on the marketplace	Contract
IP address and device information	Security, fraud prevention, analytics	Legitimate interest
Cookies and usage data	Platform functionality and analytics	Consent / Legitimate interest
Newsletter subscription preference	Sending marketing emails (only if opted in)	Consent

3. How We Use Your Data

— To provide and operate the Platform (account management, purchases, downloads).
— To process payments and manage subscriptions via Stripe.
— To communicate with you about your account, purchases, and Platform updates.
— To detect and prevent fraud, abuse, and unauthorised access.
— To send marketing emails, but only if you have opted in.
— To comply with legal obligations.

4. How Long We Retain Data

— Account data: retained for the duration of your account, plus up to 3 years after closure (for legal compliance).
— Purchase records: retained for 7 years (EU accounting regulations).
— Marketing consent: until you withdraw consent or unsubscribe.
— Log and analytics data: up to 26 months.

5. Who We Share Data With

We do not sell your personal data. We share data only with trusted service providers necessary to operate the Platform:

— Stripe — payment processing. Data processed under Stripe's own Privacy Policy.
— Cloudflare R2 — cloud storage for audio files and images.
— Analytics providers — aggregated, anonymised usage statistics.
— Legal authorities — where required by law or court order.

All third-party processors are bound by data processing agreements and may not use your data for their own purposes.

6. International Data Transfers

Some service providers (e.g. Stripe, Cloudflare) may process data outside the European Economic Area. In such cases, we ensure appropriate safeguards are in place, such as Standard Contractual Clauses approved by the European Commission.

7. Your Rights Under GDPR

As an EU/EEA resident, you have the following rights:

→ Access: request a copy of the personal data we hold about you.
→ Rectification: correct inaccurate or incomplete data.
→ Erasure: request deletion of your data ("right to be forgotten"), subject to legal retention obligations.
→ Restriction: request that we limit processing of your data in certain circumstances.
→ Portability: receive your data in a structured, machine-readable format.
→ Objection: object to processing based on legitimate interest or for direct marketing.
→ Withdraw consent: at any time for consent-based processing (e.g. newsletter).

To exercise any of these rights, email [email protected]. We will respond within 30 days. You also have the right to lodge a complaint with your national data protection authority.

8. Cookies

We use essential cookies required for the Platform to function (e.g. session management, CSRF protection). We may also use analytics cookies to understand how the Platform is used. You can control non-essential cookies through your browser settings. For full details, see our Cookie Policy (coming soon).

9. Security

We use industry-standard security measures including HTTPS encryption, hashed passwords, and access controls to protect your data. However, no transmission over the internet is completely secure. Please keep your account credentials confidential.

10. Changes to This Policy

We may update this Privacy Policy to reflect changes in law or our practices. We will notify you by email or via the Platform before any material changes take effect.

11. Contact

For privacy-related questions, contact our data protection contact at [email protected].