Privacy Policy

Who we are

This site is operated by Frost Levelz, trading as Frost Level Investment Group, a sole trader based in the United Kingdom. We are the data controller for the personal information described here.

Contact: Frostlevelmanagement@gmail.com. A postal address is available on request by email.

What we collect

• Your email address — when you buy something, create an account, or subscribe.
• Purchase records — what you bought, when, the amount paid, and a payment reference, together with how many times you have downloaded it.
• Account and subscription details — your sign-in history and, if you subscribe, your subscription status and renewal date.
• Comments— the name and message you post. These are public on the site, so please don't include anything private.
• A one-way hash of your IP address — used only to limit how often comments can be posted. We do not store your actual IP address, and the hash cannot be reversed to identify you.

What we don't collect

We never see or store your card details — payments are handled entirely by Stripe. We do not use analytics, advertising, tracking pixels or third-party cookies, and we do not profile you or make automated decisions about you.

Cookies

We use two cookies, both strictly necessary:

• Session cookie — keeps you signed in for up to 90 days. Without it you could not stay logged in.
• Sign-in security cookie — a short-lived value (10 minutes) used only during Google sign-in to verify the request genuinely came from you.

Neither is used for tracking or advertising, which is why you aren't asked to accept cookies.

Why we use your data

• To fulfil your order — delivering your music, sending your confirmation, and providing your subscription. This is necessary to perform our contract with you.
• To keep the site working and safe— preventing spam and abuse, and enforcing download limits. This is our legitimate interest in protecting the site and the artist's work.
• To meet legal obligations — keeping records of sales for tax and accounting purposes.

We do not send marketing email. If we ever do, it will be with your explicit consent and every message will let you unsubscribe.

Who else handles your data

We use these providers, and only for the purposes described:

• Stripe — payments and subscription billing.
• Convex — our database and file storage, hosted in the United States.
• Resend — sending confirmation and sign-in emails, processed in Ireland.
• Hostinger — the server the website runs on.
• Google — only if you choose to sign in with Google, in which case Google confirms your email address to us. We receive nothing else.

Because our database is hosted in the United States, your data is transferred outside the UK. That transfer relies on the safeguards in our providers' data processing terms. We do not sell your data or share it for advertising.

How long we keep it

• Sign-in links expire after 15 minutes and can only be used once.
• Sessions expire after 90 days, or immediately when you sign out.
• Sales records are kept for six years, as UK tax rules require.
• Account details are kept until you ask us to delete them. Comments stay until removed by you or by us.

Your rights

You have the right to ask for a copy of your data, to have it corrected or erased, to restrict or object to how we use it, and to receive it in a portable format. Email us and we will respond within one month.

Note that we may need to keep sales records even after deleting your account, because tax law requires it.

If you are unhappy with how we have handled your data, you can complain to the Information Commissioner's Office at ico.org.uk.

Children

This site is not aimed at children under 13, and we do not knowingly collect their data. If you believe a child has given us personal information, please contact us and we will delete it.

Changes

If we change this policy we will update the date at the top of this page.