Privacy Policy
We collect only what we need to run the shop, fulfill beat leases and EP applications, prevent abuse, and reply to you. We do not sell personal data.
Pending counsel review. These documents are operational templates for a digital beat storefront. They are not a substitute for advice from qualified music, privacy, or tax counsel. Live payments stay disabled until rights clearance and counsel sign-off are recorded in the launch runbook.
- Checkout and delivery use your email, order identifiers, and payment status from Stripe.
- EP applications store the information and PDF you submit for review.
- Preview playback and shop progress may use local browser storage on your device.
- We do not sell personal information.
- Contact support to request access or deletion where applicable.
1. Who we are
This Privacy Policy explains how Nate Fox / Beat Thrift Shop (“we”, “us”) handles personal information when you visit natefox.wtf, browse or preview beats, check out a lease, or apply for an EP collaboration.
2. Information we collect
Depending on how you use the site, we may process:
- Contact details you provide (email address; EP application fields such as name, links, and project notes).
- Order and fulfillment data (cart contents, license tier, terms version accepted, order/status identifiers, delivery timestamps).
- Payment metadata from Stripe (we do not store full card numbers on our servers).
- Technical logs needed for security and reliability (IP address, user agent, approximate timestamps, error diagnostics).
- Device-local shop state (crate, passport, player preferences) stored in your browser — not sent as a persistent profile unless required for checkout.
3. Why we use it
We use personal information to:
- Provide previews, catalog browsing, and the interactive shop experience.
- Process payments, issue licenses, and deliver private download links and PDFs.
- Review EP collaboration applications and communicate about them.
- Prevent fraud, abuse, and unauthorized access to masters.
- Comply with law, tax, and accounting obligations.
- Improve reliability (aggregated, non-marketing diagnostics where configured).
4. Processors and sharing
We share data only with service providers that help operate the product, under contracts that limit their use of the data:
- Stripe — payment processing.
- PostgreSQL host — durable guest orders and collab applications.
- Amazon S3 / Cloudflare R2 — version-pinned private master delivery; public preview CDN when configured.
- Resend — transactional email.
- Vercel — application hosting.
5. Retention
Paid-order records, license snapshots, and fulfillment artifacts are retained as long as needed for delivery, dispute handling, tax/accounting, and fraud prevention, then deleted or anonymized according to our operational schedule.
The current proposed operational periods (subject to counsel/tax approval before automated deletion) are: paid orders and license evidence for 7 years; fulfillment payloads and signed-link text for 30 days after fulfillment; abandoned or failed unpaid checkouts for 90 days; declined or undecided EP applications for 180 days; selected EP applications for the relationship term plus 7 years; provider operational logs for up to 30 days where configurable.
EP application PDFs and related fields are retained while under review and for a reasonable period afterward unless you ask us to delete them earlier and we are not legally required to keep them.
Server logs are retained for a short operational window unless needed for an active security investigation.
6. Cookies and local storage
The shop uses first-party local/session storage for crate, passport, and player continuity. We do not rely on third-party advertising cookies for this product surface. Strict browser privacy modes may clear local state.
7. Your choices
Depending on your location, you may have rights to access, correct, delete, or export personal information, or to object to certain processing. Email the support address published at checkout / on the site. We may need to verify the request and will explain if an exception applies (for example, orders we must keep for tax law).
8. Children
The site is directed to adults. We do not knowingly collect personal information from children under 13 (or the higher age required in your region).
9. International transfers
Infrastructure may process data in the United States and other countries where our providers operate. Where required, we use appropriate transfer safeguards offered by those providers.
10. Changes
We may update this Policy under a new version string. The effective date and version above identify the current text. Material changes will be reflected on this page before they apply to new collection.
11. Contact
Privacy questions: use the support email shown on completed order emails and the site contact surfaces once published.