This Privacy Policy explains how Cambrian Music collects, uses, shares, and protects your information.
1. What We Collect
- Account data: name, email, username, password hash, profile information you provide.
- Payment data: processed by Stripe Connect. Cambrian Music does not store full card numbers, bank account numbers, or other raw payment credentials — these are handled directly by Stripe under its own privacy policy and PCI-DSS obligations.
- Content data: audio files, metadata, artwork, and other materials you upload, including anything submitted for a Human Authorship Record.
- Usage data: pages viewed, features used, session duration, device/browser type, and similar analytics collected via PostHog.
- Communications: support requests, messages sent through the platform, and correspondence with us.
2. How We Use It
- To operate the platform (hosting your content, processing subscriptions, calculating chart rankings for The Scene, running the Release Ready mastering wizard).
- To process payments and payouts through Stripe Connect, including tax reporting where legally required.
- To detect fraud, abuse, and violations of our terms.
- To improve the product using aggregated/anonymized usage analytics.
- To communicate with you about your account, releases, or policy changes.
3. What We Share
- Service providers: Stripe (payments), Supabase (file storage), Neon (database), PostHog (analytics), Cloudflare (hosting/CDN), and similar vendors, each bound by their own data processing terms.
- Legal disclosure: if required by law, subpoena, or to protect the rights, safety, or property of Cambrian Music, our users, or the public.
- Business transfers: if Cambrian Music is acquired or merges with another company, user data may transfer as part of that transaction, subject to this policy (or a materially similar one).
We do not sell your personal data to third parties.
4. Your Choices
- You can access, correct, or delete your account data from your account settings or by contacting support@cambrianmusic.com.
- You may request a copy of your data or ask that it be deleted, subject to legal retention requirements (e.g., financial records tied to payouts).
- Depending on your location, you may have additional rights under laws like GDPR (EU/UK) or CCPA (California) — e.g., the right to opt out of certain data uses, or to lodge a complaint with a supervisory authority.
5. Data Retention & Security
We retain account and transaction data for as long as your account is active and as needed to comply with legal, tax, and accounting obligations.
We take reasonable measures designed to protect data on Cambrian Music, including:
- Encryption in transit: all traffic between your device and our platform is encrypted (TLS/HTTPS).
- Encryption at rest: data stored in our database and file storage providers is encrypted at rest by those providers.
- Payment data: handled entirely by Stripe Connect under Stripe's own PCI-DSS-compliant infrastructure. We never see or store full card numbers or bank account numbers.
- Access controls: internal access to user data and systems is limited to what's needed to operate the platform, and is not shared with or sold to third parties beyond the service providers listed in Section 3.
- Infrastructure protections: our hosting and content-delivery infrastructure includes active, automated defenses against common attacks — including DDoS mitigation, web application firewall rules, and rate limiting — that monitor and block malicious traffic on an ongoing basis.
- Ongoing practice: we follow current, generally-accepted security practices for a platform of our size and continue to adapt them as our infrastructure and the threat landscape evolve.
- Vulnerability reporting: see the Responsible Security Disclosure section of our Terms of Service for how to report a security issue to us responsibly.
No Guarantee of Absolute Security
No method of transmission or storage is 100% secure, and we cannot guarantee absolute security of your data. You acknowledge that any transmission of data to or from Cambrian Music is at your own risk, and that you're responsible for maintaining the confidentiality of your own account credentials and for any activity that occurs because those credentials were compromised through no fault of ours (e.g., reused passwords, phishing, malware on your device).
Limitation of Liability for Security Incidents
To the maximum extent permitted by law, Cambrian Music is not liable for unauthorized access to, alteration of, or loss of your data resulting from circumstances beyond our reasonable control, including but not limited to: vulnerabilities in third-party services we rely on (Stripe, Supabase, Neon, Cloudflare, PostHog), sophisticated attacks that evade industry-standard defenses, or your own failure to safeguard your account credentials. This limitation is subject to the overall liability cap in our Terms of Service and does not apply where liability cannot be excluded under applicable law (for example, our own gross negligence or willful misconduct, or statutory obligations described below).
Breach Notification
If a security incident compromises your personal data in a way that triggers a legal notification duty, we will notify affected users and any required regulators within the timeframe required by applicable law.
6. Children's Privacy
Cambrian Music is not directed at children under 13 (or the minimum age required by your jurisdiction), and we do not knowingly collect data from them.
7. Changes to This Policy
We'll post updates here and, for material changes, notify users via email or an in-app notice before the changes take effect.