Privacy notice

BEATLAB AUDIO operates this digital sounds and tools store. The data controller is BEATLAB AUDIO, Rua da Ternura 42, Nova Lima - MG, Brazil, 34009-556.

Questions about anything in this notice — including exercising any of your rights below — go to beatlabaudio@gmail.com.

• —Account data. Your name, email address and a password — stored only as a salted hash, never in plain text — when you register or sign in.
• —Order data. What you bought, when, at what price, and your download history. Billing itself is handled by our payment providers; full card details never touch our servers.
• —Mailing list. Your email address, and where you joined from (the footer form or a free-pack page), if you subscribe.
• —Technical logs. Standard server logs (IP address, timestamps) needed to run and secure the site. Nothing beyond that.

UK GDPR requires a lawful basis for everything we do with your data. Here is the honest map:

• —Running your account and delivering your downloads — contract: we can't sell you a download without it.
• —Taking payment and keeping order records — contract, and legal obligation for the records UK tax law requires us to keep.
• —Sending the mailing list — consent. You opted in; every email carries an unsubscribe link, and unsubscribing stops the mail without touching anything else.
• —Keeping the site secure and preventing fraud — legitimate interests. We keep this narrow and never use it to market at you.

Essential cookies keep you signed in and remember your basket and discount code. Our typefaces are served from our own domain. Optional analytics and advertising measurement start off and require a separate choice. Cookie preferences shows whether optional measurement is enabled for this store.

Open Cookie preferences in the footer to allow analytics, allow advertising measurement, or reject both. Browsing, listening and buying do not require either permission. We store your choices against an opaque browser cookie for up to six months. Analytics events use a random session identifier, without your email, IP address or user agent in the event table. With permission, configured Google Analytics or Meta measurement may receive product and purchase information and a random event identifier. Advertising permission also covers advertising personalization; advertising and analytics have separate switches.

Changing your choices stops future optional collection and cancels queued measurement for the purposes you withdraw. A request already sent cannot be recalled. If saving fails, the preferences panel says so; please retry to update the server's saved choices. This does not delete records we need to fulfil purchases or maintain the payment ledger.

Payments are processed by Stripe and PayPal. We receive the order confirmation — what was bought and whether it was paid — but never see your full card details. Those live with the payment providers under their own security and privacy regimes.

We share personal data only with the services needed to run the store:

• —Payments: Stripe and PayPal.
• —Email delivery: transactional email (order confirmations, download links) is sent through Resend.
• —Hosting: Vercel for the application, Supabase for the database and Cloudflare R2 for product files and audio previews.

We do not sell your data, and we do not share it for anyone else's marketing.

Your data is held by the providers that run the store: Vercel (website hosting, United States), Supabase (database), Cloudflare R2 (download files), Stripe (payments) and Resend (email). Some of them process data outside the UK, mainly in the United States. Where they do, the transfer is covered by the UK Extension to the EU–US Data Privacy Framework or the UK International Data Transfer Addendum, under each provider's data processing terms.

• —Account and download history — while your account is active. Delete your account and we delete the personal data with it, subject to the order records below.
• —Order records — six years after the order, to meet tax and accounting requirements .
• —Mailing list — until you unsubscribe, and then gone.
• —Server logs — up to 30 days, then deleted.

Under UK GDPR you have the right to:

• —Access your personal data, and get a copy of it.
• —Correct anything inaccurate.
• —Erase it (the “right to be forgotten”), within the legal limits.
• —Restrict or object to processing.
• —Portability — take your data elsewhere in a usable format.
• —Withdraw consent where consent is the basis — unsubscribing is exactly this, one click.

Ask at beatlabaudio@gmail.com and we will respond within one month. You don't need to explain why. If you're unhappy with how we handle your data, you can complain to the Information Commissioner's Office at ico.org.uk.

We'll update this notice as the store grows. This version is dated 14 November 2026.