Privacy Policy
Last updated: 2026-08-23. This policy explains what personal data Awa Sounds collects, why, and your rights under UK GDPR and the Data Protection Act 2018.
1. What data we collect
- Account data: email address, display name, and any profile information you choose to add (artist name, bio, genre) when you create an Awa Sounds account.
- Transaction data: beat or service purchases (processed via GoDaddy Payments / Stripe). We do not store your card details — payment processors handle these directly.
- Contact form data: name, email and message when you submit an enquiry or demo.
- Usage data: anonymised analytics (pages visited, session duration) collected without cookies where possible. If cookies are used you will be asked for consent first.
- Content data: lyrics, playlists and saved beats you create inside your account.
2. Why we collect it (lawful basis)
- Contract performance: to create and manage your account, fulfil beat purchases and deliver digital files.
- Legitimate interests: to improve the website, prevent fraud, and respond to enquiries.
- Legal obligation: to keep financial records as required by UK law.
- Consent: for optional marketing emails or non-essential cookies — you can withdraw consent at any time.
3. Who we share data with
- Supabase (EU region): our database and authentication provider. Data stored in Ireland under standard contractual clauses.
- GoDaddy / Stripe: payment processing. See their privacy policies for how card data is handled.
- Web3Forms: contact form delivery. Only your name, email and message are forwarded.
- We do not sell your personal data to third parties. We do not use your data for advertising profiling.
4. How long we keep data
- Account data: until you delete your account, plus 30 days for backup.
- Transaction records: 7 years (UK tax law).
- Contact form messages: 12 months.
- Usage analytics: 26 months (rolling).
5. Your rights
Under UK GDPR you have the right to:
- Access the personal data we hold about you.
- Have inaccurate data corrected.
- Have your data erased ("right to be forgotten") where no overriding legal obligation applies.
- Restrict or object to processing.
- Data portability — receive your data in a machine-readable format.
- Withdraw consent at any time (where consent is the lawful basis).
To exercise any right, email awasoundsenquires@gmail.com. We will respond within 30 days. You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.
6. Cookies
We aim to use only strictly necessary cookies (authentication session tokens). If we add analytics or marketing cookies in future, we will display a consent banner and update this policy. You can control cookies at any time via your browser settings.
7. Children
Our services are intended for users aged 16 and over. We do not knowingly collect data from children under 16. If you believe a child has created an account, contact us and we will remove it promptly.
8. Security
We use HTTPS encryption, Supabase Row-Level Security (RLS), and access controls to protect your data. No internet transmission is 100% secure; we continuously review our practices to minimise risk.
9. Changes to this policy
We will notify registered users by email of material changes at least 14 days before they take effect. The "last updated" date at the top always reflects the current version.