Privacy Policy

1. Information We Collect

Account Information

When you create an account, we collect your email address, a password (stored as a salted hash — we never see your plaintext password), your username, and the role you select (producer, artist, or both). You may optionally provide a display name, bio, profile photo, location, and links to your social profiles.

Content You Upload

Producers upload audio files, artwork, metadata (title, BPM, key, genre, tags, description), license terms, and collaborator information. This Content is stored on our infrastructure so we can serve it through the Service.

Transaction and Payment Information

Subscription payments are processed by LemonSqueezy, which acts as our Merchant of Record. Beat sale payments are processed by Stripe via Stripe Connect. Both processors handle card numbers, bank details, billing addresses, and tax information directly — this data never touches our servers. We receive and store only transaction metadata from these processors: a transaction ID, amount, currency, tier or item purchased, and the associated user. For payouts, the relevant processor provides us with a customer ID and a payout account reference so we can link sales back to the correct Producer.

Usage and Device Information

We automatically collect limited usage data so we can operate and improve the Service: pages viewed, features used, beats played, search queries, approximate location derived from IP address (country and region, not a precise address), device type, operating system, and browser. We log request metadata for security, debugging, and abuse prevention.

Communications

If you message another User, submit feedback, or contact support, we store the content of those messages to deliver them and to resolve disputes.

Third-Party Connections

If you choose to connect your YouTube, SoundCloud, Spotify, DistroKid, or TuneCore account, we store OAuth tokens (encrypted) and the stats those services return so you can see unified analytics. You can disconnect these at any time.

2. How We Use Information

• To provide and operate the Service — hosting beats, showing you relevant discovery, processing licenses, delivering messages.
• To process transactions through LemonSqueezy (subscriptions) and Stripe (beat sales), including paying Producers for their sales.
• To communicate with you about your account, purchases, and important service changes.
• To send marketing emails — only if you opt in. You can opt out anytime from Settings or the unsubscribe link in any marketing email.
• To detect, prevent, and respond to fraud, abuse, security issues, and violations of our Terms.
• To improve the Service, including training and evaluating analytics, search ranking, and recommendation features.
• To comply with legal obligations such as tax reporting requirements (handled via LemonSqueezy and Stripe) and valid law enforcement requests.

3. Cookies and Similar Technologies

We use cookies and similar technologies to:

• Keep you signed in (a session cookie set by our authentication provider, Supabase).
• Remember your preferences (e.g., filter settings).
• Measure how the Service is used in aggregate, via first-party analytics.
• Protect against CSRF, bot attacks, and other security threats.

We do not use third-party advertising cookies. You can clear cookies in your browser settings; doing so will sign you out of the Service.

4. Third-Party Services

We rely on a small set of trusted providers to run the Service. Each has its own privacy practices; we link to them below.

• Supabase — database, authentication, and file storage. supabase.com/privacy
• LemonSqueezy — subscription billing and Merchant of Record. lemonsqueezy.com/privacy
• Stripe — beat sale payments via Stripe Connect. stripe.com/privacy
• Vercel — hosting and content delivery. vercel.com/legal/privacy-policy
• Resend — transactional email delivery. resend.com/legal/privacy-policy
• YouTube, SoundCloud, Spotify, DistroKid, TuneCore — only when you connect these accounts. We access and store the analytics data you explicitly authorize.

5. How We Share Information

We do not sell or rent personal data. We share information only in these limited circumstances:

• With other Users when you publish a profile, upload a beat, send a message, or respond to a request — that information becomes visible to the intended audience.
• With LemonSqueezy and Stripe to process payments and send payouts to Producers.
• With service providers (listed above) who help us operate the Service under strict confidentiality obligations.
• For legal reasons — to comply with valid legal process, protect our rights or safety, investigate fraud, or respond to a government request that meets applicable legal standards.
• In a business transfer — if Lyvex is involved in a merger, acquisition, or asset sale, personal information may be transferred as part of that transaction. We will notify you before your information becomes subject to a different policy.

We do not sell personal data. We also do not use personal data for cross-context behavioral advertising.

6. Your Rights

Depending on where you live, you may have some or all of the following rights:

• Access — ask for a copy of the personal data we hold about you.
• Correct — update inaccurate information. Most profile fields are editable directly in your Settings.
• Delete — close your account and request deletion of your data. Some information may be retained where we have a legal obligation (e.g., tax records via LemonSqueezy or Stripe) or a legitimate interest (e.g., fraud prevention).
• Export — receive a machine-readable copy of the data you provided.
• Object or Restrict — object to certain processing or ask us to restrict it.
• Opt out of marketing — unsubscribe from any marketing email or toggle preferences in Settings.

To exercise any of these rights, email privacy@example.com. We respond within 30 days. We may need to verify your identity before acting on a request.

7. Data Retention

We retain personal data for as long as you have an active account. If you close your account, we delete or anonymize most personal data within 30 days, except: transaction records retained by LemonSqueezy and Stripe for tax and accounting purposes; license records provided to Buyers, which remain valid; and information we must keep to comply with law, resolve disputes, or enforce our Terms.

8. Data Security

We use industry-standard measures to protect your data: TLS encryption in transit, encryption at rest, row-level security on our database, least-privilege access controls, and regular security reviews. No online service is 100% secure; if we detect a breach that affects your data, we will notify you promptly and, where required, the applicable regulators.

9. International Data Transfers

Our infrastructure may process data in the United States and other countries. When we transfer personal data from regions with data protection laws (such as the EEA, UK, or Switzerland) to countries without an adequacy decision, we rely on appropriate safeguards such as Standard Contractual Clauses.

10. Children's Privacy

The Service is not directed to children under 13 and we do not knowingly collect personal information from children under 13. If you believe a child has provided us with personal information, contact privacy@example.com and we will delete it promptly.

11. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we'll update the "Last updated" date at the top and, for material changes, notify you by email or in-product notice.

12. Contact

For privacy questions or to exercise your rights, email privacy@example.com. For all other support, email support@example.com.