Privacy

Who holds your data

M3 Beatz LLC is the controller of everything described here. Questions and requests go to realm3beatz@gmail.com.

What is collected

• Your email address and name, entered at checkout. The email is where files are delivered; the name is written into the license agreement.
• Order records — which beat, which tier, amount, currency, and a reference id from the payment processor.
• Your acceptance of the license — which version of the terms you agreed to at checkout, the time, your IP address, and your browser's user-agent string. This is the record of the contract, and it is what a payment dispute is answered with.
• Download activity — the time, file and IP address for each download, so a shared or abused link can be spotted.
• Aggregate play counts per beat. These are counts only and are not tied to a person.
• Aggregate visit counts — page views, approximate country, and the site that linked here. Cookieless, and not tied to a person.

Why, and on what basis

Your email, name and order record are needed to perform the contract — without them there is nowhere to send the files and no license to point at. The acceptance record, download log and rate-limit counters are kept because we have a legitimate interest in being able to prove what was agreed, defend a chargeback, and stop the store being abused. Nothing here is used for advertising or profiling, and no decision about you is made automatically.

What is not collected

No card numbers, bank details or payment credentials reach this site — those go straight to Stripe or PayPal. There are no advertising trackers, no marketing pixels, and no cross-site tracking of any kind. Visits are counted, as described below, but nothing here builds a profile of you or follows you off this site.

Cookies and what your browser stores

No tracking cookies. What is stored is only what the site needs to work:

• After a completed purchase, your email address and name are saved in a cookie so the checkout form can prefill next time. It is readable only by the server, not by scripts on the page, and it expires on its own.
• A session cookie exists only while the store owner is signed in to the dashboard.
• Your cart, your starred beats, any lyrics you write, and the fact that you accepted the terms are held in your own browser's local storage. None of it is ever sent to the server, and clearing your browser data deletes all of it.

Visitor numbers are measured without cookies and without any attempt to identify you. No profile is built, nothing follows you to other sites, and there is no advertising pixel anywhere on this store.

How the site measures its own traffic

We count page views, roughly where in the world visitors are, and which links bring people here, so it is possible to tell whether anyone found a new beat. This is aggregate: it is a count of visits, not a record of yours.

Separately, the store counts how many times each beat's preview has been started. That number is attached to the beat, never to a person — it is how the catalog knows what is popular, and it is the same figure shown publicly on a beat.

Who it is shared with

Only the services required to run the store: Supabase (database, file storage, authentication), Stripe and PayPal (payments), Resend (delivery email), and Vercel (hosting, and the cookieless traffic counting described above). Each acts on our instructions and receives only what it needs. Your data is never sold, and never shared for anyone else's marketing.

If a payment is disputed, the order and delivery records described above are given to the payment processor as evidence — that is the whole reason they are kept.

Marketing email

Delivery and recovery emails are transactional and always sent, because they are how you receive what you bought. There is currently no marketing list and no marketing email is sent. If that ever changes it will be opt-in, and every message will carry an unsubscribe link.

How long it is kept

Order records, and the license acceptance attached to them, are kept as long as the license lasts and as long as tax and accounting rules require — a license is perpetual, so the record of it has to outlast any argument about it. Download logs are kept while they are useful for spotting abuse and answering disputes. Download tokens expire on their own, and rate-limit counters are discarded within days.

Your rights

You can ask for a copy of your data, ask for it to be corrected, ask for it to be deleted, or object to how it is used. Write from the address you bought with. Two limits are worth being straight about: the order and acceptance record for a live license cannot be erased while the license exists, because it is the license, and records needed for tax are kept for as long as the law says.

If you are in the UK or EU and are not satisfied with how a request was handled, you can complain to your national data protection authority.