Privacy Notice — Rhythmosia Music

This Privacy Notice explains how Rhythmosia Music ("we", "us", "our") collects and processes personal data when you use our website and services. Rhythmosia Music acts as the data controller for the personal data described below.

1. Data we collect

Account data: email address, hashed password, account identifiers.
Order data: tracks purchased, order identifiers, download history.
Support / messaging data: messages you send us through the in-app inbox.
Technical data: IP address, browser and device identifiers, logs, telemetry.

Payment card and billing data is collected directly by our Merchant of Record, Paddle, not by us.

2. Purposes and legal bases

Creating and operating your account — contract performance.
Delivering purchased tracks and download links — contract performance.
Providing customer support via the in-app inbox — contract / legitimate interests.
Security, fraud prevention, and abuse detection — legitimate interests.
Complying with legal, tax, and accounting obligations — legal obligation.
Improving our service — legitimate interests.

3. Sharing your data

We share personal data with the following categories of recipients:

Paddle — our Merchant of Record for sales, subscription management, payments, tax compliance, invoicing, and refund handling.
Hosting and infrastructure providers — for site hosting, database, storage of audio files, and application logs.
Professional advisers — legal, accounting, and tax advisers where needed.
Authorities — where required by law or valid legal process.

4. Data retention

We keep account and order data for as long as your account is active and for as long as reasonably needed to comply with legal, tax, and accounting requirements. When the data is no longer needed, we delete or anonymise it.

5. Your rights

Depending on your jurisdiction, you may have rights to access, correct, delete, restrict or object to processing, port your data, and withdraw consent. To exercise any of these rights, contact us through the in-app contact form. Users in the UK/EEA also have the right to lodge a complaint with their supervisory authority; we aim to respond within one month.

6. International transfers

Our providers may process data outside your country. Where data leaves the UK/EEA, we rely on appropriate safeguards such as Standard Contractual Clauses or adequacy decisions.

7. Security

We use appropriate technical and organisational measures — including encryption in transit, hashed passwords, access controls, and audit logging — to protect personal data against unauthorised access, loss, or misuse.

8. Cookies

We use essential cookies and similar technologies required to keep you signed in and to operate the checkout. We do not use advertising cookies.

9. Contact

For any privacy questions or to exercise your rights, contact Rhythmosia Music through the contact page.