RXCVRDO

Privacy policy

Draft for solicitor review (24 October 2026). Words in [square brackets] need filling in.

RXCVRDO Sounds is run by [Company name] Ltd ("we"), [registered address], registered with the Information Commissioner's Office under number [ICO registration number]. We're the controller of the personal information described here. If you have any questions, email [privacy email address].

The short version

  • We only collect what we need to run the site: your account, what you buy and sell, and how you use the site to recommend sounds.
  • We don't sell your information, we don't show adverts, and we don't use tracking or analytics cookies.
  • Who you follow and what you like is private. Only the number of followers a creator has is public.
  • Payments and bank details are handled by Stripe. We never see your full card or bank details.
  • You can ask to see, correct or delete your information at any time.

What we collect

Your account

  • Your email address, and your name and username. If you sign in with Google, we get your name and email from Google; we don't get your Google password or anything else from your Google account.
  • If you sign up with email, your password is stored securely by our login provider (only a scrambled version, never the password itself).
  • Anything you add to your profile, such as a bio and links. Creators' profiles are public; buyers' profiles aren't.

What you buy

  • Your purchases, tokens, downloads and beat licences, with dates and prices, and any refund requests you make (including the reason you give).
  • Before you pay, you tick a box agreeing to get your purchase straight away (see our refund policy). We keep a record of that with the payment.
  • Card payments are made on Stripe's pages. Stripe tells us the payment worked and the amount; we never receive your full card number.

If you sell on the site (creators)

  • The sounds, artwork and details you upload, and confirmation that you own or control the rights to them.
  • What you've earned and been paid. To pay you, Stripe collects your identity details and bank account and checks them; we only keep a reference to your Stripe account and whether it can receive money.

How you use the site

  • Sounds you like, creators you follow, and previews you listen to for more than a few seconds. If you're signed in, we use these to pick sounds for you ("For you"). If you're not signed in, a listen is counted with nothing that identifies you, and only adds to what's popular this week.
  • Nobody else can see what you've liked or who you follow, not even the creators. Creators' follower counts are public.

Messages and reports

  • If you report a sound (for example a copyright claim), the details you give us: your name, email, who owns the rights and why you're reporting it. We may share these with the creator so they can respond, as our copyright policy explains.
  • Emails we send you, and any you send us.

Security information

  • To stop abuse (such as people trying to guess passwords or spamming forms), we count attempts from each internet connection. We store a scrambled code made from your IP address, not the address itself, and delete it after about a day.
  • A security check from Cloudflare (Turnstile) on sign-in and some forms, which looks at your browser to tell people from bots.
  • A record of important actions (such as payments, refunds and takedowns) so we can check what happened if something goes wrong.

Why we use it, and our legal reasons (UK GDPR)

  • Running your account, selling to you, delivering downloads, paying creators, and emails about all of these: to carry out our contract with you.
  • Keeping financial and tax records, checking creators' identities for payouts, handling copyright claims: legal obligations.
  • Recommending sounds from your likes, follows and listens, and counting what's popular: our legitimate interest in helping people find music they'll like and creators find listeners. You can ask us to stop.
  • Preventing fraud, abuse and spam, and keeping the site secure: our legitimate interest in keeping the site and its users safe.

We don't send marketing emails. If we ever want to, we'll ask first.

Who we share it with

We use these companies to run the site. They only use your information to provide their service to us:

  • Supabase (database and login), hosting your account and site data in [region].
  • Cloudflare (file storage for sounds and artwork, and the Turnstile security check).
  • Stripe (card payments, tokens subscriptions, and creator payouts, including identity checks).
  • Resend (sending emails).
  • Google, only if you choose to sign in with Google.
  • [Hosting provider, e.g. Vercel] (running the website).

We also share information when the law requires it (for example with HM Revenue & Customs about creators' earnings, under the digital platform reporting rules), or to deal with a legal claim. We never sell your information.

Some of these companies store information outside the UK. When they do, they protect it with the safeguards UK law requires, such as the UK's approved contract terms. [Confirm for each provider.]

Cookies

We only use cookies that the site needs to work:

  • Sign-in cookies, which keep you signed in. Without them you couldn't use your account.
  • A short-lived cookie that lets you set a new password straight after opening a password-reset email. It lasts 15 minutes.
  • Cloudflare Turnstile may use its own cookie or similar storage to run the security check.

When you pay, you're on Stripe's own pages, which use Stripe's cookies (see Stripe's privacy policy). We don't use advertising, tracking or analytics cookies, so there's nothing to opt into.

How long we keep it

  • Your account: until you delete it (Account → Delete your account) or ask us to. After that we delete your profile, likes, follows and listens, and keep only what the law requires.
  • Your listens (signed in): while you have an account; recommendations only use the last 90 days.
  • Purchases, payments, earnings and payouts: [6 years] after the end of the tax year they relate to, because the law requires it.
  • Anonymous listens: 30 days.
  • Security codes made from IP addresses: about a day.
  • Copyright reports and records of actions taken: [6 years], in case of a legal claim.

Your rights

You can ask us to:

  • give you a copy of your information;
  • correct anything that's wrong;
  • delete your information (we'll keep only what the law requires). You can delete your account yourself from your account page;
  • stop using it for recommendations, or restrict how we use it;
  • send your information to you or someone else in a common format.

Email [privacy email address] and we'll reply within a month. It's free. If you're unhappy with how we've handled your information, please tell us first. You can also complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.

Age

You must be at least [18], or have permission from a parent or guardian, to buy on the site or sell as a creator.

Changes

If we change this policy in a way that matters, we'll tell you by email or on the site before it takes effect. This version is dated [date].